Description
用友NC系统的/ebvp/register/qrySubPurchaseOrgByParentPk接口存在SQL时间盲注漏洞，攻击者可通过构造含DBMS_PIPE.RECEIVE_MESSAGE的恶意pk_group参数，利用响应时间差执行时间盲注，窃取数据库敏感信息。
用友NC /ebvp/register/qrySubPurchaseOrgByParentPk SQL 注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://mrxn.net/jswz/yonyou-nc-ebvp-register-qrySubPurchaseOrgByParentPk-sqli.html
http://7dian.us/cves/9013e2a0.html
https://zhuanlan.zhihu.com/p/1932214870562047555
https://github.com/kk12-30/2025hvv
https://www.tutusec.com/author/3/page/4?orderby=comment_count&tab=post&status=publish
https://www.cnblogs.com/0day-li/p/19007070