| शीर्षक | Xinghu OA v2.3.2 sensitive information leaked |
|---|
| विवरण | Xinghu OA v2.3.2 version has any data backup in the frontend. An attacker can use this vulnerability to obtain the administrator password and successfully log in to the backend.
1、Access the url to back up the sql file and return success successfully.
task.php?m=sys|runt&a=beifen
2、you need to blast the folder name (1000-9999) and the number of data rows in the OA user table
Then access the corresponding json file to obtain the backed up data, and then obtain the administrator password |
|---|
| स्रोत | ⚠️ https://github.com/magicwave18/vuldb/issues/2 |
|---|
| उपयोगकर्ता | magicwave18 (UID 52598) |
|---|
| सबमिशन | 24/09/2023 12:49 PM (3 साल पहले) |
|---|
| संयम | 29/09/2023 04:27 PM (5 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 240927 [Xinhu RockOA 2.3.2 task.php?m=sys|runt&a=beifen start सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|