漏洞描述
Wanhu ezOFFICE 是一款协同管理平台，广泛应用于企业和组织的办公自动化中。该漏洞存在于 wf_printnum.jsp 文件中，攻击者可以通过构造恶意的 SQL 查询语句，利用该漏洞进行数据库的未授权访问，可能导致敏感信息泄露、数据篡改或破坏。
Wanhu ezOFFICE /defaultroot/platform/bpm/work_flow/operate/wf_printnum.jsp;.js SQL 注入漏洞（CVE-2024-1012）
PoC代码
暂无相关漏洞推荐
- POC 万户ezOFFICE协同管理平台 /defaultroot/modules/govoffice/gov_documentmanager/receivefile_gd.jsp;.js SQL 注入漏洞
- 万户ezOFFICE协同管理平台 /defaultroot/platform/custom/customizecenter/js/getAutoCode.jsp;.js SQL 注入漏洞
- 万户ezOFFICE协同平台 /defaultroot/iWebOfficeSign/OfficeServer.jsp/../../modules/hrm/report/customize/checkSQL_httprequest.jsp SQL 注入漏洞
- 万户 ezOFFICE WeiXin!callback.action XXE漏洞
- 万户 ezOFFICE /defaultroot/wpsservlet loadFile 文件读取漏洞（CNVD-2021-76461）
- 万户 ezOFFICE /defaultroot/platform/report/graphreport/graph_include.jsp SQL 注入漏洞
- POC wanhu-documentedit-sqli: WanhuOA DocumentEdit.jsp - SQL Injection
- POC wanhu-download-ftp-file-read: Wanhu OA download_ftp.jsp - Arbitrary File Read
- POC wanhu-download-old-file-read: Wanhu OA download_old.jsp - Arbitrary File Read
- POC wanhu-oa-fileupload-controller: Wanhu OA Fileupload Controller - Arbitrary File Upload
- POC wanhu-teleconferenceservice-xxe: Wanhu OA TeleConferenceService Interface - XML External Entity Injection
- POC wanhuoa-downloadservlet-lfi: Wanhu OA DownloadServlet - Remote File Disclosure
- POC wanhuoa-officeserverservlet-file-upload: Wanhu OA OfficeServerServlet - Arbitrary File Upload