Description 该漏洞是泛微云桥 e-Bridge 的 sendWxMsg 接口存在 SQL 注入漏洞,攻击者可通过构造恶意参数进行 SQL 注入,进而获取数据库敏感信息或提升权限,风险等级为高危。
References https://www.gm7.org/archives/49034 https://cn-sec.com/archives/5066629.html https://security.zone.ci/secarticles/wx/511053.html https://www.gm7.org/archives/48984 https://security.zone.ci/e/tags/?tagname=sendwxmsg%E6%8E%A5%E5%8F%A3
Related VulnerabilitiesPoCCVE-2026-59726: ruflo MCP Bridge - Unauthenticated RCE via terminal_executeWordPress Time Capsule /wp-tcapsule-bridge/upload/php/index.php 文件上传漏洞(CVE-2024-8856)Homebridge Config UI X /api/auth/login 默认口令漏洞PoChomebridge-default-login: Homebridge - Default Admin CredentialsHomebridge存在默认口令PoC泛微云桥 e-Bridge sendWxMsg 接口存在SQL注入漏洞PoChomebridge-unfinished-install: Homebridge - Unfinished Installationecology-ebridge-addtaste-sqli: 泛微云桥 taste/addTaste SQL注入PoCCVE-2020-11853: Micro Focus Operations Bridge Manager <=2020.05 - Remote Code ExecutionPoCCVE-2021-22502: Micro Focus Operations Bridge Reporter - Remote Code ExecutionPoCCVE-2021-25112: WordPress WHMCS Bridge <6.4b - Cross-Site ScriptingPoCCVE-2025-4008: MeteoBridge <= 6.1 - Remote Code Execution