Description
孚盟云CRM系统的/m/Dingding/Ajax/AjaxCustomerList.ashx接口存在SQL时间盲注漏洞，攻击者可通过构造恶意custFID参数注入SQL语句，利用WAITFOR DELAY实现时间延迟，获取数据库敏感信息，进一步可能导致系统被入侵控制。
孚盟云CRM /m/Dingding/Ajax/AjaxCustomerList.ashx SQL 注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://mrxn.net/jswz/fumacrm-Dingding-Ajax-AjaxCustomerList-sqli.html
https://www.ddpoc.com/DVB-2025-10542.html
https://vip.bdziyi.com/category/ldxq/page/4/
https://www.gm7.org/archives/33957
https://zone.ci/secarticles/wx/482102.html