Description 索贝产品中的 /sobey-mchEditor/tianma/op接口存在SQL注入漏洞,攻击者可以通过构造恶意的SQL语句,获取数据库中的敏感信息,甚至可能导致数据库被完全控制。
References https://mrxn.net/jswz/sobey-tianma-op-ids-sqli.html https://www.ddpoc.com/DVB-2025-9938.html https://bdziyi.com/60344/ https://cn-sec.com/archives/tag/%E7%B4%A2%E8%B4%9D%E8%9E%8D https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E6%88%90%E9%83%BD%E7%B4%A2%E8%B4%9D%E6%95%B0%E7%A0%81%E7%A7%91%E6%8A%80/%E7%B4%A2%E8%B4%9D%E8%9E%8D%E5%AA%92%E4%BD%93restore%20%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md https://www.secevery.com/toBugInfo?id=1859196223271780353 https://www.ddpoc.com/DVB-2024-8478.html https://nosec.org/m/share/5900.html https://mrxn.net/jswz/sobey-tianma-op-ids-sqli.html
Related Vulnerabilities索贝融媒体 /sobey-mchEditor/count/getCountByCode SQL 注入漏洞PoC索贝融媒体 /sobey-mchEditor/mch/Jzt/statistics/countJztArticleGroupByChannel2 SQL 注入漏洞索贝融媒体 /sobey-mchEditor/mch/Articlelist/articleExamineExport SQL 注入漏洞索贝融媒体 /sobey-mchEditor/mch/jztEditorScore/queryEditorScoreRank SQL 注入漏洞索贝融媒体 /sobey-mchEditor/count/catalogArticles SQL 注入漏洞索贝融媒体 /sobey-mchEditor/mch/WXArticleInt/restore SQL注入漏洞索贝 /sobey-mchEditor/mch/statistics/countWxarticleByChannel SQL 注入漏洞