Zhixiang OA SQL Injection Scanner

Zhixiang OA is an office automation software used by various organizations to manage internal office procedures and document management efficiently. It is widely utilized by enterprises to streamline workflow, enhance productivity, and facilitate communication within the organization. Developed with a focus on optimizing office tasks, Zhixiang OA is used across multiple sectors, including governmental agencies, educational institutions, and private enterprises. Its functionalities include document management, scheduling, messaging, and task management, all geared towards improving organizational efficiency.

SQL Injection is a critical vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code through input fields. When exploited, it can lead to unauthorized data access, deletion, or modification, potentially compromising sensitive information. The vulnerability is common in applications that fail to properly sanitize user inputs before incorporating them into SQL statements. In Zhixiang OA, this flaw can arise from insufficient input validation in various modules, particularly those handling search, filter, or data submission functions.

Specifically, the vulnerability exists in the document search endpoint of Zhixiang OA, where user-supplied parameters such as 'keyword' or 'category' are directly concatenated into SQL queries without proper escaping or parameterization. An attacker can inject malicious SQL payloads through these parameters, bypassing authentication and gaining direct access to the underlying database. This endpoint is commonly used for retrieving documents based on user input, making it a prime target for exploitation.

If exploited, an attacker could extract sensitive information such as user credentials, internal documents, and configuration data from the database. They could also modify or delete records, leading to data integrity issues and potential service disruption. In worst-case scenarios, the attacker might gain administrative access to the entire system, compromising the confidentiality, integrity, and availability of the organization's data. This could result in significant financial and reputational damage, as well as legal consequences for failing to protect sensitive information.