通达OA集团最新版一处盲注漏洞demo测试（需登录）

简要描述： 集团OA最新版，未过滤'，然后再绕过过滤函数，root权限 详细说明： 厂商官网：http://.../ 集团demo地址：.../ SQL漏洞地址： .../general/document/index.php/send/sendlist/sendfor/?tid=&title=1 参数title可注入 这个点竟然没有过滤单引号' 爆SQL语句： 提交： .../general/document/index.php/send/sendlist/sendfor/?tid=&title=1%' and 1=2 union select 返回： 不安全的SQL语句：联合查询...

通达OA /interface/auth.php SQL注入

通达OA 两处注入点： /interface/auth.php /general/score/flow/scoredate/result.php 主要原因还是由于宽字符导致的。 MYSQL的字符集转换过程 1. MySQL Server收到请求时将请求数据从charactersetclient转换为charactersetconnection； 2. 进行内部操作前将请求数据从charactersetconnection转换为内部操作字符集，其确定方法如下： • 使用每个数据字段的CHARACTER SET设定值； • 若上述值不存在，则使用对应数据表的DEFAULT CHARACTER...

齐普生协同办公OA系统存在SQL注入漏洞

No description provided by source...

黄城OA系统 /frame/help/read_help.php SQL注入漏洞

No description provided by source...

北京希尔自动化OA管理系统/数据库系统 /bnuoa/info/infoShowAction.do 任意文件下载漏洞

No description provided by source...

泛微OA系统敏感文件未授权访问

No description provided by source...

双杨OA系统存在GBK宽字符SQL注入漏洞

No description provided by source...

猫扑OA 2014 后台登陆验证存在SQL注入漏洞

No description provided by source...

万户OA defaultroot/download_ftp.jsp 任意文件下载漏洞

No description provided by source...

通达OA /logincheck.php处 sql注入

No description provided by source...

泛微 OA /tools/SWFUpload/upload.jsp 任意文件上传漏洞

发现 tools/SWFUpload/upload.jsp ，并未验证当前用户是否为登录状态，提交文件，可直接写入根目录下。最终得到的文件访问路径为：http://www.xxoo.com/null上传的文件名.jsp。本地构造提交表单form method='post' action='http://www.xxoo.com/tools/SWFUpload/upload.jsp' enctype="multipart/form-data" input type="file" id="file" name="test" style="height:20px;BORDER: 8F908B...

万户OA某页面通用性SQL注入（影响N个政府网和医疗机构）

简要描述： 万户OA某页面通用性SQL注入（影响N个政府网和医疗机构） 详细说明： defaultroot/Logon.do 该页面存在越权访问，由于appinstanceid参数过滤不严，导致了SQL注入的产生 问题参数：appinstanceid EXP：defaultroot/Logon.do 利用方法：访问该页面，输入任意内容，抓包获取，SQLMAP跑之 涉及案例： ...:7001/defaultroot/aep/login.jsp http://.../defaultroot/aep/login.jsp http://...:7001/defaultroot/Logon.do...

Arbitrary File Upload Vulnerability in Panavision OA System

Panavision OA Office System is a coordination office software. A SQL injection vulnerability exists in Panmicro OA Office System, which can be exploited by an attacker to obtain sensitive information from a website database...

Generalized Arbitrary File Download Vulnerability in Safi OA Management System

Safe OA management system is an office system developed by ASP.NET, and customers involved in medicine, finance, schools, administration and many other units. There is a generic arbitrary file download vulnerability in Safi OA Management System, which can be exploited by an attacker to download...

Multiple SQL Injection Vulnerabilities in Jinhe Collaboration Management Platform

Jinhe OA collaborative management platform using asp.net and sqlserver technology development, the use of many users. There are multiple SQL injection vulnerabilities in OA Collaboration Management Platform. Attackers are allowed to utilize common SQL injection tools to obtain sensitive database...

Multiple SQL Injection Vulnerabilities in Beijing Jinhe C6 Collaborative Management Platform

Jinhe OA is developed with asp.net and sqlserver technology and is used by many users. There are multiple SQL injection vulnerabilities in the OA system. However, these injections need to log in to the system to be able to use the OA system for sql filtering, but the filtering is not strict enoug...

上海泛微网络科技股份有限公司办公系统信息泄露

简要描述： 上海泛微网络科技股份有限公司自身的办公系统信息泄露 详细说明： 泛微也是使用自己开发的OA系统，目前版本是8.0，存在一处敏感文件未授权访问导致的员工组织架构泄漏风险。可被用来进行暴力破解等攻击。 测试时进行了简单的弱密码枚举，发现60多个员工的密码是123456 域名：www.e-cology.com.cn 存在问题的url: http://www.e-cology.com.cn/messager/users.data 该文件包含了所有员工的loginid、姓名、邮箱、手机号、职位等信息。loginid即是登录oa的用户名。 该问题进行了base64编码，内容如下： 解码后...

金蝶协同办公系统 GETSHELL漏洞

简要描述： 详细说明： 金蝶OA系统在web.xml中配置了一个servlet Connector，是基于旧版本的fckeditor，存在任意文件上传漏洞，配置如下： com.fredck.FCKeditor.connector.ConnectorServlet.class反编译出主要代码如下： public void doPostHttpServletRequest request, HttpServletResponse response throws ServletException, IOException …… String commandStr =...

华天动力OA系统弱口令加任意文件上传，分秒钟沦陷服务器

简要描述： 华天动力OA系统弱口令加任意文件上传，分秒钟沦陷服务器 详细说明： 华天动力OA系统默认存在弱口令用户，登录弱口令用户后可上传任意文件，直接拿shell,并且由于系统数据库是root，权限很高，服务器直接沦陷 漏洞证明： 1.下载华天最新版OA http://software.oa8000.com/download/Version/V7.0/11-TAMYSQL5D-%E8%AF%95%E7%94%A8%E7%89%88%E5%B8%A6%E6%95%B0%E6%8D%AE%E4%B8%89%E5%90%88%E4%B8%80MYSQLPUE-7.0-2015-06-29.e...

SQL Injection Vulnerability in Zhixiang OA Office System/mainpage/msg.aspx?user=parameters

Zhixiang OA office system is an enterprise office system. A SQL injection vulnerability exists in the OpenWindows/OpenleibiezlMc.aspx?id= parameter of the Zhixiang OA Office System, which can be exploited by an attacker to obtain sensitive information from the database...