[★]Rongzhitong-dispatch-user-findAll-name-SQL-injection-English.
输入“/”快速插入内容
[★]Rongzhitong-dispatch-user-findAll-name-SQL-injection-English.
[★]Rongzhitong-dispatch-user-findAll-name-SQL-injection-English.
6月17日修改
Company：Rongzhitong Technology (Beijing) Co., Ltd.
Product: Rongzhitong Dispatch Platform (调度平台)
Affected version: All versions
Vulnerability Type: CWE-89 (SQL Injection)
Attack Vector: Network (Remote)
漏洞描述 (Description)：
A Critical unauthenticated SQL injection vulnerability has been identified in the Rongzhitong Dispatch Platform developed by Rongzhitong Technology (Beijing) Co., Ltd.
The vulnerability exists in the /dm/dispatch/user/findAll interface. The name parameter is not properly validated or filtered before being concatenated into backend SQL queries, allowing a remote attacker to inject malicious SQL statements without any authentication.
Successful exploitation may allow an unauthenticated attacker to obtain database privileges, enumerate database tables, extract sensitive information (including user credentials and business data), and potentially modify backend data. This may further affect the confidentiality, integrity, and availability of the dispatch platform.
Impact Score (*CVSS* v3.1):
•
Attack Vector (AV): Network
•
Attack Complexity (AC): Low
•
Privileges Required (PR): None
•
User Interaction (UI): None
•
Scope (S): Changed
•
Confidentiality (C): High
•
Integrity (I): High
•
Availability (A): High
Vendor Asset Proof
Company size / business registration proof of Rongzhitong Technology (Beijing) Co., Ltd.
Vulnerability POC
Asset fingerprint: body="base/searchInfoWindow_min.css"
The login page of the affected dispatch platform looks like this.
POC
GET /dm/dispatch/user/findAll?name=1' HTTP/1.1
Host: 43.138.25.3:6443
Sec-Ch-Ua: "Chromium";v="116", "Not)A;Brand";v="24", "Google Chrome";v="116"
Sec-Ch-Ua-Mobile: ?0