References https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E9%A3%9E%E4%BC%81%E4%BA%92%E8%81%94/%E9%A3%9E%E4%BC%81%E4%BA%92%E8%81%94Ognl%E8%A1%A8%E8%BE%BE%E5%BC%8F%E6%B3%A8%E5%85%A5%E5%AF%BC%E8%87%B4RCE.md https://github.com/ax1sX/SecurityList/blob/main/Java_OA/FEOAv6.51.md https://cloud.tencent.com/developer/article/2479742 https://idocdown.com/app/articles/blogs/detail/8184 https://unsafe.sh/go-202816.html https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E9%A3%9E%E4%BC%81%E4%BA%92%E8%81%94/%E9%A3%9E%E4%BC%81%E4%BA%92%E8%81%94Ognl%E8%A1%A8%E8%BE%BE%E5%BC%8F%E6%B3%A8%E5%85%A5%E5%AF%BC%E8%87%B4RCE.md
Related Vulnerabilities飞企互联 FE企业运营管理平台 /loginService.fe 权限绕过漏洞飞企互联 FE 业务协作平台 servlet/webchat/attachment/1 文件读取漏洞飞企互联-FE企业运营管理平台 attachment/1 存在任意文件读取feiqi-parsetree-sqli: 飞企互联-FE企业运营管理平台 parseTree 接口SQL注入飞企互联 OA FEwork /remoteServlet 远程代码执行漏洞飞企互联-FE企业运营管理平台 /sys/treeXml.js SQL 注入漏洞飞企互联-FE企业运营管理平台 /common/ajax_codewidget39.jsp;.js SQL 注入漏洞飞企互联-FE企业运营管理平台 /common/efficientCodewidget39.jsp;.js SQL 注入漏洞