| शीर्षक | ibos oa system v4.5.5 sql injection |
|---|
| विवरण | SQL injection vulnerability exists in ibos oa v4.5.5
official website:http://www.ibos.com.cn/
version:4.5.5
In the ibos oa v4.5.5 website deployment, at the function point ==> "Integrated office" = "Recruitment management" = "Status" = "Interview" .
There is an sql injection point in the parameter passed by post, and the root user can be obtained.
Using burpsuite to capture the packet, it returned a json format of information, and found a sql error return.
Save the POST package and use sqlmap for sql injection and finnally get a root user. |
|---|
| स्रोत | ⚠️ https://github.com/Wkingxc/CVE/blob/master/ibos_OA.md |
|---|
| उपयोगकर्ता | wkingxc (UID 50531) |
|---|
| सबमिशन | 12/07/2023 04:54 PM (3 साल पहले) |
|---|
| संयम | 21/07/2023 10:23 PM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 235147 [IBOS OA 4.5.5 Interview edit&op=status resumeid SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|