References https://cn-sec.com/archives/2370918.html https://cn-sec.com/archives/2323904.html https://www.mhtsec.com/334/ https://stack.chaitin.com/poc/detail/4663 https://github.com/adysec/POC/blob/main/wpoc/%E5%85%A8%E7%A8%8B%E4%BA%91OA/%E5%85%A8%E7%A8%8B%E4%BA%91OA__ajax.ashxSQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md https://blog.csdn.net/qq_41904294/article/details/135708887 https://blog.csdn.net/waxcj/article/details/135420362 https://cn-sec.com/archives/tag/%E5%85%A8%E7%A8%8B%E4%BA%91oa
Related VulnerabilitiesPoCCVE-2026-19598: Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX RouterPoCCVE-2025-26399: SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE金和OA /c6/JHSoft.Web.CostControl/Decompose/AjaxForCenterBudgetDecompose.ashx SQL 注入漏洞vBulletin /ajax/render/pagenav 代码执行漏洞(CVE-2026-61511)MasterStudy LMS /wp-admin/admin-ajax.php?action=stm_lms_load_content 文件包含漏洞(CVE-2024-3136)WordPress LearnPress /wp-json/lp/v1/load_content_via_ajax 信息泄露漏洞(CVE-2025-11368)WordPress Opal Estate Pro /wp-admin/admin-ajax.php 权限绕过漏洞(CVE-2025-6934)Campcodes Online Loan Management System /ajax.php SQL 注入漏洞(CVE-2025-9744)WordPress Frontend Login and Registration Blocks /wp-admin/admin-ajax.php 权限绕过漏洞(CVE-2025-3605)WordPress Realtyna Organic IDX /?wpl_format=f:property_listing:ajax SQL 注入漏洞 (CVE-2024-32128)WordPress ProfileGrid /wp-admin/admin-ajax.php SQL 注入漏洞(CVE-2024-30490)孚盟云CRM /m/Dingding/Ajax/AjaxProductList.ashx SQL 注入漏洞PrestaShop ProductsAlert /module/productsalert/AjaxProcess SQL 注入漏洞(CVE-2024-36683)