| 标题 | BeiJing Seeyon Internet Software Corp. Zhiyuan Interconnect FE Collaborative Office Platform security_addUser.jsp SQL Injection |
|---|
| 描述 | The FE Collaborative Office Platform developed by Beijing Zhiyuan Interconnect Software Co., Ltd. contains an SQL injection vulnerability in the /security/addUser.jsp interface. The input parameters are not properly filtered, allowing attackers to craft malicious requests that trigger the SQL injection vulnerability. Successfully exploiting this vulnerability can lead to the leakage of sensitive database information (such as user credentials and system configurations). Some verified affected systems have a database user with sa (system administrator) privileges, representing a high risk.
● Affected Product: Zhiyuan Interconnect FE Collaborative Office Platform (Note: Not the Feiqi Interconnect products).
● Verification Feature: Potentially affected assets can be identified by searching app="Zhiyuan Interconnect-FE" using network space mapping tools like Fofa.
Technical Details: The groupId parameter is not filtered, and attackers can inject characters (such as 1*) to trigger database errors or blind injections. |
|---|
| 来源 | ⚠️ https://github.com/CloudRoam7/CVE/blob/main/CVE_1.md |
|---|
| 用户 | cloudroam (UID 81847) |
|---|
| 提交 | 2025-02-23 05時48分 (1 年前) |
|---|
| 管理 | 2025-03-06 09時46分 (11 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 298772 [Seeyon Zhiyuan Interconnect FE Collaborative Office Platform /security/addUser.jsp SQL注入] |
|---|
| 积分 | 20 |
|---|