帆软报表 sc_getconnectioninfo 存在数据库敏感信息泄露

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://blog.csdn.net/qq_35938621/article/details/124416155
• https://disk.scan.cm/All_wiki/%E4%BD%A9%E5%A5%87PeiQi-WIKI-POC-2021-7-20%E6%BC%8F%E6%B4%9E%E5%BA%93/PeiQi_Wiki/OA%E4%BA%A7%E5%93%81%E6%BC%8F%E6%B4%9E/%E5%B8%86%E8%BD%AF%E6%8A%A5%E8%A1%A8%202012%20%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.md?hash=6b2qz0V8
• https://cn-sec.com/archives/2217499.html
• https://blog.csdn.net/gaochao/article/details/153861209
• https://cn-sec.com/archives/3307469.html
• https://blog.csdn.net/weixin_51345872/article/details/126699712/
• https://blog.csdn.net/weixin_29322553/article/details/158246036
• https://blog.csdn.net/weixin_29324401/article/details/158672561

Related Vulnerabilities

• 帆软报表存在未授权访问漏洞
• PoCCNVD-2018-04757: 帆软报表 V8 get_geo_json 任意文件读取漏洞
• PoCfanruan-finereport-fr-log-rce: 帆软 FineReport Fr Log Rce
• PoCfanruan-oa-v9-designsavevg-upload-file: 帆软报表 V9 design_save_svg 任意文件覆盖文件上传
• PoCseeyon-fanruan-report-server-directory-travesal: 致远OA 帆软组件 ReportServer 目录遍历漏洞
• PoCfine-report-v9-file-upload: FineReport v9 Arbitrary File Overwrite
• PoCfinereport-path-traversal: FineReport 8.0 - Local File Inclusion
• PoCfinereport-sqli-rce: FineReport SQLi - Remote Code Execution
• 致远OA-帆软报表组件 dbcommit 命令执行漏洞
• 帆软报表 dbcommit 命令执行漏洞
• 帆软pdf接口远程命令执行
• 帆软报表 /report/v9/print/ie/pdf SQL注入漏洞
• PoC帆软 WebReport plugin_logdb JDBC 漏洞