帆软报表 export/excel 存在SQL注入漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://help.fanruan.com/finereport/doc-view-4833.html
• https://www.cnblogs.com/Domren/articles/19505536
• https://zhuanlan.zhihu.com/p/1984679882719008353
• https://www.reddit.com/r/websecurityresearch/comments/1pvx5mi/%E5%B8%86%E8%BD%AFexportexcel_sql%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E5%8F%8A%E5%A4%8D%E7%8E%B0_analysis_and/
• https://github.com/Sec-Fork/POC-20241008/blob/main/%E5%B8%86%E8%BD%AF%E6%8A%A5%E8%A1%A8/%E5%B8%86%E8%BD%AF%E7%B3%BB%E7%BB%9FReportServer%E5%AD%98%E5%9C%A8SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%E5%AF%BC%E8%87%B4RCE.md
• https://github.com/ibaiw/2024Hvv/blob/main/%E5%B8%86%E8%BD%AFFineReport%E6%8A%A5%E8%A1%A8%20ReportServer%20SQL%E6%B3%A8%E5%85%A5getshell.md
• https://www.oscs1024.com/hd/MPS-rsdq-bj4m
• https://cn-sec.com/archives/3008988.html
• https://cloud.tencent.com/developer/article/2443297
• https://www.oschina.net/news/303541

Related Vulnerabilities

• PoC帆软报表 export/excel SQL 注入漏洞