Description
宏景eHR人力资源管理软件是一款人力资源管理Q与数字化应用相融合，满足动态化、协同化、流程化、战略化需求的软件。宏景eHR /templates/attestation/../../hire/zp_options/get_org_tree.jsp接口处存在SQL注入漏洞，未经过身份认证的远程攻击者可利用此漏洞执行任意SQL指令，从而窃取数据库敏感信息。
宏景eHR /templates/attestation/../../hire/zp_options/get_org_tree.jsp SQL 注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/0day404/HV-2024-POC/blob/main/%E5%AE%8F%E6%99%AFeHR-report_org_collect_tree.jsp%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/qq_36618918/article/details/135557652
https://stack.chaitin.com/poc/detail/3854
https://buaq.net/go-194589.html
https://www.secrss.com/articles/54590
https://update.nsfocusglobal.com/update/listNewipsDetail/v/rule5.6.11