Description 通达OA系统,即OfficAnywhere,又称为网络智能办公系统,是通达科技公司针对各行业办公与管理开发的办公应用系统。该系统存在未授权访问,攻击者可通过该漏洞获取数据库敏感信息
References https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E9%80%9A%E8%BE%BEOA/%E9%80%9A%E8%BE%BEOA%20down.php%E6%8E%A5%E5%8F%A3%E5%AD%98%E5%9C%A8%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E.md https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/%E9%80%9A%E8%BE%BEAO/%E9%80%9A%E8%BE%BEAO%2011.5%20%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E/ https://blog.csdn.net/qq_50854662/article/details/128149305 https://www.ddpoc.com/DVB-2024-8286.html https://cloud.baidu.com/article/2831485 https://www.cnblogs.com/xiaoyunxiaogang/p/16913391.html https://cloud.tencent.com/developer/article/2288066 https://disk.scan.cm/All_wiki/%E5%90%84%E7%B1%BB%E6%8A%80%E6%9C%AF%E6%96%87%E7%8C%AE%2B%E5%90%AB%E9%9B%B6%E7%BB%842021-07%E6%9C%88%E5%89%8D%E6%89%80%E6%9C%89%E6%96%87%E7%AB%A0Markdown%E7%89%88/library/003-%E6%BC%8F%E6%B4%9E%E7%9B%B8%E5%85%B3/001-%E9%80%9A%E8%BE%BEOA/020-%E9%80%9A%E8%BE%BEAO%2011.5%20%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E.md?hash=zE0KEPGJ https://developer.aliyun.com/article/1219760 https://www.secrss.com/articles/17947
Related Vulnerabilities通达OA v11.7 delete_cascade.php SQL 注入漏洞通达OA /general/reportshop/utils/upload.php 文件上传漏洞(CNVD-2021-21890)通达OA delete_seal.php SQL 注入漏洞(CVE-2023-4165)通达OA /pda/apps/report/getdata.php 文件上传漏洞通达OA delete_log.php SQL 注入漏洞(CVE-2023-4166)tongda-handle-sqli: 通达OA handle SQL注入tongda-v11-getdata-rce: 通达OA v11.9 getdata 任意命令执行漏洞PoCCVE-2023-4166-2: 通达OA seal_manage SQL 注入