yonyou nc 漏洞列表

fofa：icon_hash="1085941792"

Yonyou NC-Cloud getStaffInfo interface has a SQL injection vulnerability. The vulnerability allows attackers to execute arbitrary SQL statements through maliciously crafted requests. FOFA: app="用友-NC-Cloud"

Fofa: app="用友-NC-Cloud"

用友 portalsesInittoolservice 泄露数据库账号密码 fofa: app="用友-UFIDA-NC"

fofa: title="YONYOU NC"

An unauthorized attacker can upload a file via the FileReceiveServlet endpoint.

Arbitrary file upload vulnerability in UFIDA N C accept.jsp . An attacker can obtain website permissions through the vulnerability.

Yonyou NC is an enterprise-level management software, widely used in large and medium-sized enterprises.Realize modeling, development, inheritance, operation, management integration of IT solution information platform.UFIDA NC for C/S architecture, the use of Java programming language development, the client can directly use UClient, the server interface for HTTP.A page of UFIDA NC6.5, there is arbitrary file upload vulnerability.The cause of vulnerability is that there is no type restriction at the uploading file, and an attacker without authentication can take advantage of this vulnerability by sending special data packets to the target system, and a remote attacker who successfully takes advantage of this vulnerability can upload any file to the target system to execute commands.

The UFIDA NC Grouptemplet Interface permits unauthenticated users to upload potentially malicious files.

UFIDA NC is in the process of processing client request data. Insufficient checking and filtering when deserializing user-supplied data can lead to malicious deserialization operations and execution of commands on the operating system. After analysis, security researchers found that the system has many exploit points for deserialization. Currently, the official vulnerability fix plan is to perform deserialization whitelist control on known exploit points and repair some exploit chain dependencies. The possibility of similar problems occurring in the system in the future is still high.

用友NC是一款企业级ERP软件。用友NC存在远程命令执行漏洞，攻击者利用该漏洞可在未授权的情况实现远程命令执行