Description
华天动力OA系统是一个以技术领先著称的协同软件产品，具有极为突出的实用性、易用性和高性价比，实施简便，使用灵便。该系统renameService接口中的传参可以导致HQL语句闭合造成SQL注入，恶意攻击者可以通过该漏洞获取数据库敏感信息或获取服务器权限。
华天动力OA /OAapp/bfapp/buffalo/renameService SQL 注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://stack.chaitin.com/vuldb/detail/367edaa1-af7e-4e3d-92bf-c3509b2fc1d8
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/oa/%E5%8D%8E%E5%A4%A9%E5%8A%A8%E5%8A%9BOA-8000%E7%89%88-workFlowService-SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md
https://yaklang.com/Yaklab/wiki/DetectionPlug-in/HTDLOA/
https://cn-sec.com/archives/3601585.html
https://cloud.tencent.com/developer/article/2324286
https://www.anquan114.com/archives/953
https://download.xray.cool/vul/453vul.pdf
http://zhousa.com/archives/76602.html