Tongda OA CVE-2023-5019 SQL注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://xxzx.aku.edu.cn/info/1222/2060.htm
• https://www.venustech.com.cn/new_type/aqtg/20230920/26265.html
• https://wlaq.njupt.edu.cn/2023/0922/c14800a247074/page.htm
• https://www.aqtd.com/nd.jsp?id=4993
• https://avd.aliyun.com/detail?id=AVD-2023-5019
• https://github.com/RuanLang0777/goby-POC3/blob/master/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA11.10_REINSTATEMENT_ID_%E5%90%8E%E5%8F%B0sql%E6%B3%A8%E5%85%A5.py
• https://stack.chaitin.com/vuldb/detail/c6131e3b-d9bb-47a2-a937-d889609c67ef
• https://cn-sec.com/archives/2052485.html
• http://net.jstu.edu.cn/2331/list23.psp
• https://www.cybersec-gd.cn/service/1773.html
• http://qianetech.com/h-nd-108.html
• https://www.dptech.com/uploadfile/2023/1012/20231012032943995.pdf
• https://zhuanlan.zhihu.com/p/657305123
• https://xxzx.aku.edu.cn/wlaq/7.htm
• http://net.jstu.edu.cn/aqgg/list23.psp
• https://nvd.nist.gov/vuln/detail/CVE-2023-5019
• https://www.cvedetails.com/cve/CVE-2023-5019/
• https://github.com/advisories/GHSA-mp4f-c796-xq7h
• https://feedly.com/cve/vendors/tongda2000
• https://vulmon.com/searchpage?q=tongda+oa

Related Vulnerabilities

• tongda-handle-sqli: 通达OA handle SQL注入
• tongda-v11-getdata-rce: 通达OA v11.9 getdata 任意命令执行漏洞
• PoCtongda-contact-list-disclosure: 通达OA v2014 get_contactlist.php 敏感信息泄漏漏洞
• PoCtongda-down-php-unauthorized-access: 通达OA down.php存在未授权访问漏洞
• PoCtongda-insert-sql-inject-getshell: 通达OA v11.6 insert SQL注入漏洞
• PoCtongda-oa-2017-auth-bypass: 通达OA 2022HW 登录认证绕过
• PoCtongda-oa-api-ali-upload: 通达OA v11.8 api.ali.php任意文件上传漏洞
• PoCtongda-oa-logincode-any-user-login: 通达OA v11.5 login_code.php 任意用户登录
• PoCtongda-online-user-session-disclosure-login: 通达OA Online User Session Disclosure and Login
• PoCtongda-path-traversal: Office Anywhere TongDa - Path Traversal
• PoCtongda-report-bi-func-sql-inject: 通达OA v11.6 report_bi.func.php SQL注入漏洞
• PoCtongda-swfupload-new-sql-inject: 通达OA v11.5 swfupload_new.php SQL注入漏洞
• PoCtongda-v11-session-disclosure-login-bypass: 通达OA v11.5 logincheck_code.php 登陆绕过漏洞