Pan micro e-cology8 foreground SQL injection POC

Catalog

1. Preface

2.POC

---

 

1. Preface

        Pan Wei ecology8 Is a OA Office products . But its version ecology8 There is a front desk SQL Inject . You can get the system administrator password hash. The vulnerability is in 2021 year 04 month 08 Japan ,HW On the first day .

                                                                                                              Fanwei official website ：https://www.weaver.com.cn/

Try to submit to CNVD On , Rejected . I wanted to pick up a hole . It's really impossible , Suddenly feel the charm of code audit .

afei

 

It says that this vulnerability is an open vulnerability , It doesn't mean 4 month 8 The no. 0day. I don't know which hole is below .