References https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/oa/%E7%94%A8%E5%8F%8B-U8-OA-getSessionList.jsp-%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.md https://www.cnblogs.com/pursue-security/p/17685227.html https://blog.csdn.net/qq_32261191/article/details/124346940 https://jiwo.org/ken/detail.php?id=3115 https://peiqi.wgpsec.org/wiki/oa/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20U8%20OA%20getSessionList.jsp%20%E6%95%8F%E6%84%9F%E4%BF%A1%E6%81%AF%E6%B3%84%E6%BC%8F%E6%BC%8F%E6%B4%9E.html https://qkl.seebug.org/vuldb/ssvid-90552 https://vulners.com/seebug/SSV:90560 https://www.cnblogs.com/xrwcm/p/17673233.html https://cn-sec.com/archives/1852450.html http://wooyun.2xss.cc/bug_detail.php?wybug_id=wooyun-2015-0156663
Related Vulnerabilities用友OA operaFileActionController 任意文件上传&覆盖漏洞用友OA CheckLogin SQL注入漏洞用友OA getallservices 信息泄露漏洞用友-OA SQL注入漏洞用友OA doUpload.jsp 任意文件上传漏洞用友OA test.jsp SQL注入漏洞用友U8-OA系统getSessionList.jsp文件cmd参数-泄漏敏感信息