健保卡網路服務元件 - Heap-based Buffer Overflow

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.twcert.org.tw/tw/cp-132-6354-1cf61-1.html
• https://www.twcert.org.tw/tw/cp-132-6227-eaf49-1.html
• https://www.twcert.org.tw/newepaper/cp-151-6354-1cf61-3.html
• https://hitcon.org/2022/slides/%E7%95%B6%E5%81%A5%E4%BF%9D%E5%8D%A1%E5%85%83%E4%BB%B6%E6%88%90%E7%82%BA%E9%A7%AD%E5%AE%A2%E7%9A%84%E4%BB%BB%E6%84%8F%E9%96%80.pdf
• https://www.twcert.org.tw/tw/lp-132-1-9-60.html
• https://www.twcert.org.tw/tw/lp-132-1-26-20.html
• https://www.twcert.org.tw/en/cp-139-6228-3211c-2.html
• https://hitcon.org/2022/en/agenda/f1a4c0f0-d5f9-4a1c-bcdd-dc3fd6109b26/

Related Vulnerabilities

• PoCCVE-2019-11043: PHP-FPM Path Info Buffer Underflow - Remote Code Execution
• 全程云 /OA/api/2.0/HR/EntryApply/GetBaseData SQL 注入漏洞
• ERPNext /api/method/erpnext.stock.doctype.material_request.material_request.get_material_requests_based_on_supplier SQL 注入漏洞（CVE-2025-52039）
• PoCCVE-2025-62613: VDO.Ninja - DOM-Based Cross-Site Scripting
• 易达科技-ECMS getProjectBaseDocData SQL注入漏洞
• PoC易达科技-ECMS getProjectBaseDocData 存在SQL注入漏洞
• PoCCVE-2022-42475: Fortinet SSL-VPN - Heap-Based Buffer Overflow
• PoCCVE-2024-22120: Zabbix Server - Time-Based Blind SQL injection
• PoCCVE-2025-22457: Ivanti Connect Secure - Stack-based Buffer Overflow
• PoCCVE-2025-8191: Swagger UI >=3.14.1 < 3.38.0 - DOM Based Cross-Site Scripting
• PoCCVE-2021-20038: SonicWall SMA100 Stack - Buffer Overflow/Remote Code Execution
• PoCCVE-2021-20167: Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun
• PoCCVE-2021-41349: Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting