| Название | https://www.fengoffice.com/ fengoffice 3.5.1.5 SQL Injection |
|---|
| Описание | The id_no_select parameter in FengOffice x.x.x.x is SQL injection.A single quote was submitted in the id_no_select parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present. Additionally, the payload '+(select*from(select(sleep(20)))a)+' was submitted in the id_no_select parameter. The application took 21140 milliseconds to respond to the request, compared with 355 milliseconds for the original request, indicating that the injected SQL command caused a time delay. |
|---|
| Источник | ⚠️ https://github.com/YZS17/CVE/blob/main/SQL/SQLi%20in%20fengoffice_3.5.1.5.md |
|---|
| Пользователь | XU17 (UID 83703) |
|---|
| Представление | 24.05.2025 17:20 (1 Год назад) |
|---|
| Модерация | 01.06.2025 12:55 (8 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 310766 [Fengoffice Feng Office 3.5.1.5 index.php?c=account&a=set_timezone tz_offset SQL-инъекция] |
|---|
| Баллы | 20 |
|---|