Description
Wanhu ezOFFICE是中国万户（Wanhu）公司的一款全面的办公套件软件。 Wanhu ezOFFICE 11.1.0版本存在SQL注入漏洞，该漏洞源于defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp 中包含一些未知处理，通过参数 recordId导致SQL注入。
Wanhu ezOFFICE SQL注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E4%B8%87%E6%88%B7OA/%E4%B8%87%E6%88%B7ezOFFICE%E5%8D%8F%E5%90%8C%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0receivefile_gd.jsp%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://cloud.tencent.com/developer/article/2443508
https://blog.csdn.net/jd_cx/article/details/148089293
https://mrxn.net/jswz/defaultroot-ezOFFICE-getNextAutoCode-sqli.html
https://starmap.dbappsecurity.com.cn/info/7049
https://ddpoc.com/DVB-2024-7947.html
https://www.yingjikeji.cn/sys-nd/633.html
https://avd.aliyun.com/detail?id=AVD-2024-1012
https://cn-sec.com/archives/4033964.html
https://www.sentinelone.com/vulnerability-database/cve-2024-1012/
https://www.cve.org/CVERecord?id=CVE-2024-1012
https://nvd.nist.gov/vuln/detail/CVE-2024-1012
https://vuldb.com/vuln/252281