致远互联FE协作办公平台 /mobile/validate.jsp;.js SQL 注入漏洞

2025-02-28 致远互联FE PoC No

Description

致远互联FE协作办公平台是一款为企业提供全方位协同办公解决方案的产品。它集成了多个功能模块，旨在帮助企业实现高效的团队协作、信息共享和文档管理。致远互联FE协作办公平台的 validate.jsp 接口存在 SQL 注入漏洞，未经身份验证的攻击者可以通过此漏洞获取数据库敏感信息，甚至进一步获取服务器权限，造成严重的安全威胁。

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E8%87%B4%E8%BF%9COA/%E8%87%B4%E8%BF%9C%E4%BA%92%E8%81%94FE%E5%8D%8F%E4%BD%9C%E5%8A%9E%E5%85%AC%E5%B9%B3%E5%8F%B0codeMoreWidget.js%E5%AD%98%E5%9C%A8sql%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://cloud.tencent.com/developer/article/2443509
https://rivers.chaitin.cn/blog/cqorbt90lnec5jjuga3g
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E8%87%B4%E8%BF%9COA/%E8%87%B4%E8%BF%9C%E4%BA%92%E8%81%94FE%E5%8D%8F%E4%BD%9C%E5%8A%9E%E5%85%AC%E5%B9%B3%E5%8F%B0apprvaddNew%E5%AD%98%E5%9C%A8sql%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://github.com/zan8in/wy876-POC/blob/main/%E8%87%B4%E8%BF%9COA/%E8%87%B4%E8%BF%9C%E4%BA%92%E8%81%94FE%E5%8D%8F%E4%BD%9C%E5%8A%9E%E5%85%AC%E5%B9%B3%E5%8F%B0ncsubjass%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5.md
https://github.com/adysec/POC/blob/main/wpoc/%E8%87%B4%E8%BF%9COA/%E8%87%B4%E8%BF%9C%E4%BA%92%E8%81%94FE%E5%8D%8F%E4%BD%9C%E5%8A%9E%E5%85%AC%E5%B9%B3%E5%8F%B0editflow_manager%E5%AD%98%E5%9C%A8sql%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md

Description

PoC

References

Related Vulnerabilities