| 标题 | NEWTYPE WebEIP 3.0 Missing Authentication, Authorization Bypass and SQL Injection |
|---|
| 描述 | WebEIP provides companies with websites that employees frequently use, which originally required login to access. However, through the vulnerabilities, it is possible to obtain employee IDs, names, and other information without login, and there is a high chance that employee signatures can be processed.
1. Missing Authorization
- Some of files are read without login. Personnel information, some online archives files information are found.
- /EIP_Com_Selector3_searchDATA.aspx
- /EIP_Com_FileList.aspx
- /EIP_MyPAGE_settingMenu.aspx
- /EIP_MyPAGE.aspx
2. Bypass Authorization
- In the file 'EIP_MyPAGE.aspx', modifying the cookie value is able to result in bypassing authorization. Employee IDs, names, and other staff information without login are found.
3. SQL injection
- In the file '/EIP_Com_Selector3_searchDATA.aspx', the parameter "data" does not properly sanitize user input before using it in an SQL query.
- Because of Missing Authorization, this vulnerability allows for SQL injection attacks without login.
- This can be exploited by sending a crafted request to the login endpoint with malicious SQL code.
|
|---|
| 来源 | ⚠️ https://drive.google.com/file/d/1BJhYjqSvYpAB2ZJGR8vD_COeICxrXNlu/view?usp=drive_link |
|---|
| 用户 | ox882 (UID 98191) |
|---|
| 提交 | 2026-06-09 08時47分 (2 月前) |
|---|
| 管理 | 2026-08-03 09時27分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 385531 [NewType WebEIP 直到 3.0 /EIP_Com_FileList.aspx 弱身份验证] |
|---|
| 积分 | 20 |
|---|