漏洞描述
PowerPMS系统的GetCreateTableScript功能存在SQL注入漏洞，攻击者可通过构造恶意输入绕过身份验证，直接操纵数据库查询语句，可能导致用户敏感信息泄露（如用户名、密码哈希值）、未授权账户接管或数据库内容篡改，需紧急修补参数化查询或输入过滤机制。
PowerPMS File.ashx存在SQL注入漏洞
PoC代码
暂无相关漏洞推荐
- POC CVE-2025-56132: LiquidFiles < 4.2 - User Enumeration via Password Reset
- POC exposed-filezilla-config: Exposed FileZilla Configuration File - Exposure
- POC craftcms-log-disclosure: Craft CMS - Log File Disclosure
- POC CVE-2025-27817: Apache Kafka Client - Arbitrary File Read
- POC CVE-2026-22200: osTicket - Arbitrary File Read
- POC symfony-lock-exposure: Symfony Lock File - Exposure
- POC pear-registry-exposed: PEAR Registry Files Exposed
- POC rubygems-credentials-exposure: Ruby Gem::ConfigFile Credential - Exposure
- POC zen-cart-log-exposure: Zen Cart Log File Exposure
- POC fortra-filecatalyst-anonymous-access: Fortra FileCatalyst - Anonymous Access
- POC sendmail-forward-exposure: Sendmail .forward File - Exposure
- 金和OA GovAIPDefineFileType.aspx SQL注入漏洞
- WordPress Drag and Drop Multiple File Upload for WooCommerce dnd_codedropz_upload_wc 文件上传漏洞（CVE-2025-4403）