References https://www.cnblogs.com/pursue-security/p/17685052.html https://www.secrss.com/articles/59147?app=1 https://www.ufida168.com/case_detail/2979.html https://github.com/xhs-d/Yongyou_GRP-U8/blob/main/README.md https://blog.csdn.net/qq_39573664/article/details/135770215 https://rivers.chaitin.cn/blog/cq70jnqp1rhtmlvvdps0 https://cloud.tencent.com/developer/article/1843616 https://nosec.org/m/share/4561.html https://www.cnblogs.com/pursue-security/p/17685037.html https://github.com/novysodope/fupo_for_yonyou https://www.cnvd.org.cn/flaw/show/CNVD-2024-23771 https://cloud.tencent.com/developer/article/2437309 https://cloud.baidu.com/article/292173 https://developer.aliyun.com/article/1338240 https://stack.chaitin.com/vuldb/detail/39c1e69a-ee6b-4c80-b740-644710182f5f
Related Vulnerabilities用友GRP-U8Cloud /jmreport/loadTableData SQL 注入漏洞用友 GRP-U8Cloud /jmreport/queryFieldBySql Freemarker 命令执行漏洞关于用友GRP-U8Cloud产品getBudgetReleaseProjectList及U8AppProxy及fbpm-modeler存在命令执行漏洞的安全通告关于用友GRP-U8Cloud产品(api/xx/xxx)存在前台sql注入导致命令执行漏洞的安全通告关于用友GRP-U8Cloud产品存在前台无条件远程命令执行漏洞的安全通告关于用友GRP-U8Cloud产品(yrule/xxx)接口存在命令执行漏洞的安全通告关于用友GRP-U8Cloud产品jmreport组件模块存漏洞的安全通告关于用友GRP-U8Cloud产品(XXX/getDataTypeList及XXX/getFAInfo)接口存在SQL注入漏洞的安全公告yonyou-grp-u8-logs-disclosure: 用友 GRP-U8 管理平台 logs 敏感信息泄露PoCyonyou-grp-u8-app-proxy-uploadfile: 用友 GRP-U8 U8AppProxy 任意文件上传PoCyonyou-grp-u8-bx_historyDataChecks-sqli: 用友GRP-U8 bx_historyDataCheck.jsp SQL注入漏洞PoCyonyou-grp-u8-fileupload: 用友 GRP U8 FileUpload存在任意文件上传漏洞PoCyonyou-grp-u8-license-check-sqli: 用友GRP-U8 license_check.jsp 存在sql注入漏洞