| タイトル | https://www.fengoffice.com/ fengoffice 3.5.1.5 SQL Injection |
|---|
| 説明 | The id_no_select parameter in FengOffice x.x.x.x is SQL injection.A single quote was submitted in the id_no_select parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present. Additionally, the payload '+(select*from(select(sleep(20)))a)+' was submitted in the id_no_select parameter. The application took 21140 milliseconds to respond to the request, compared with 355 milliseconds for the original request, indicating that the injected SQL command caused a time delay. |
|---|
| ソース | ⚠️ https://github.com/YZS17/CVE/blob/main/SQL/SQLi%20in%20fengoffice_3.5.1.5.md |
|---|
| ユーザー | XU17 (UID 83703) |
|---|
| 送信 | 2025年05月24日 17:20 (1 年 ago) |
|---|
| モデレーション | 2025年06月01日 12:55 (8 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 310766 [Fengoffice Feng Office 3.5.1.5 index.php?c=account&a=set_timezone tz_offset SQLインジェクション] |
|---|
| ポイント | 20 |
|---|