Description
蓝凌OA系统的/sys/ui/sys_ui_component/sysUiComponent.do接口存在文件移动漏洞，攻击者可通过构造恶意请求后通过/resource/help/km/review/dataxml.jsp执行任意系统命令。该漏洞源于未对用户输入进行严格过滤，导致攻击者可注入操作系统指令，进而控制服务器。
蓝凌OA /sys/ui/sys_ui_component/sysUiComponent.do 命令执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.cnblogs.com/spmonkey/p/17858153.html
https://github.com/Only-MrLi/POC/blob/main/%E8%93%9D%E5%87%8COAsysUiComponent_%E6%96%87%E4%BB%B6%E5%AD%98%E5%9C%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/qq_33906495/article/details/135220684
https://www.clicksun.com.cn/mis/bbs/showapp.asp?id=25945
https://stack.chaitin.com/tool/detail/1256
https://cn-sec.com/archives/2973613.html
https://www.lmboke.com/archives/lan-ling-oalou-dong-li-yong-zong-jie
https://wiki.tntsec.com/docs/bug/oa/%E8%93%9D%E5%87%8C/%E8%93%9D%E5%87%8CKEP%E5%AD%98%E5%9C%A8%E5%89%8D%E5%8F%B0sysUiComponent.do%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.html