启莱OA系统/client/checkuser.aspx SQL 注入

No description provided by source...

用友U8-OA系统/yyoa/ext/https/getSessionList.jsp文件敏感信息泄漏漏洞

No description provided by source...

用友oa getSessionList.jsp信息泄露

https://g.jiuminghu.com/newwindow=1&q=intitle:%E3%80%8A%E7%94%A8%E5%8F%8BU8-OA%E3%80%8B&btnK=+%E6%90%9C%E7%B4%A2 intitle:《用友U8-OA》 谷歌搜索即可搜出来大量案例 漏洞存在于：http://www.example.com/yyoa/ext/https/getSessionList.jsp?cmd=getAll 该漏洞允许攻击者获取所有用户的用户名和密码MD5值...

双杨OA系统 /DSOA_TY/goods/GoodsAdd.aspx SQL注入漏洞

双杨OA系统/DSOATY/goods/GoodsAdd.aspx SQL注入漏洞 注入参数 goodsid http://xinhuachongming.com.cn/DSOATY/goods/GoodsAdd.aspx?goodsid=1%20and%201=user&flag=2 http://xinhuachongming.com.cn/DSOATY/goods/GoodsAdd.aspx?goodsid=1%20and%201=@@SERVERNAME&flag=2...

PT-2016-4225

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.1 through 12.2 Description The issue affects confidentiality and is related to the REST Framework in the Application Mgmt Pack for E-Business Suite component. It has been suggested that this might be an XML...

泛微OA系统日志泄露漏洞

No description provided by source...

泛微OA系统第三方组件jqueryFileTree不安全配置导致目录遍历

可遍历至操作系统任意目录，只能查看文件名及大小等信息，但是遍历整个oa的目录，收获还是很大的，比如log文件、文本文件等都会对渗透有很大的帮助。有些log文件会包含数据库操作记录，比如更改oa登录密码等，如此便可不费吹灰之力登录oa。 文件：/js/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.jsp jqueryFileTree在很多通用软件中用的还比较多，该文件接受dir参数来浏览指定的目录，部分代码： / jQuery File Tree JSP Connector Version 1.0 Copyright 200...

泛微 OA sysinterface/codeEdit.jsp 页面任意文件上传

0x01 漏洞概述 相关厂商： 泛微OA 官方主页： http://www.weaver.com.cn/ 公开时间： 2015-11-25 漏洞类型： 非授权访问/权限绕过 无需登录上传文件。 http://localhost:8088/sysinterface/codeEdit.jsp?filename=5308.java&filetype=java filename为文件名称 为空时会自动创建。 0x02 漏洞利用 代码详情 String fileid = "Ewv"; String readonly = ""; boolean isCreate = false;...

泛微OA某处缺陷可遍历和操作系统文件

简要描述： RT 详细说明： 文件位于plugin\ewe\jsp\config.jsp 新建一个文档 删除成功 img src="https://images.seebug...

泛微oa /iWebOffice/OfficeServer.php /iWebOffice/OfficeServer2.php 任意文件读取漏洞

No description provided by source...

泛微oa /webservice/upload.php /webservice/upload/upload.php 等多处任意文件上传

任意文件上传共四处，属于同一个漏洞 文件位置 /webservice/upload.php /webservice/upload/upload.php /webservice-json/upload/upload.php /webservice-xml/upload/upload.php 四处都有如下代码 没有对文件有任何验证，无须登陆 文件上传之后的位置是： $path = $ATTACHPATH.$attachmentID; $fileName = $path."/".$FILES'file''name'; moveuploadedfile $FILES'file''tmpname'...

Arbitrary User Login Vulnerability in Xiaowei OA System of Beijing Xiaowei Help Technology Co.

Xiaowei OA system is Beijing Xiaowei Help Technology Co., Ltd. to provide mobile office platform for small and medium-sized enterprises. There is an arbitrary user login vulnerability in the Xiaowei OA system that allows attackers to arbitrarily register users to log in to the system and obtain...

泛微OA 信息泄露漏洞

No description provided by source...

通达OA 获取用户信息接口信息泄漏漏洞

No description provided by source...

泛微OA HrmCareerApplyPerView.jsp SQL注入漏洞

No description provided by source...

泛微OA 任意文件上传漏洞

No description provided by source...

泛微OA PreDownload.jsp SQL注入漏洞

No description provided by source...

通达OA任意文件上传漏洞

No description provided by source...

通达OA系统 logincheck.php SQL注入

No description provided by source...

SQL Injection Vulnerability in Panmicro OA Office System

Panavision OA Office System is a coordination office software. Panmicro OA Office System suffers from a SQL injection vulnerability and a lack of filtering of the formName parameter, which can be exploited by an attacker to obtain sensitive information from a website database...