用友协作办公平台通杀SQL注入

至少影响到5.5.2版本(不知道是不是最新)..

#漏洞文件

/cooperate/traceNodes.jsp

漏洞代码如下
 

<%
User user = (User)ResourceManage.getSession("User");
Dao dao= (Dao)ResourceManage.getContext("dao");
String traceNodeGUID= HtmlFormat.format(request.getParameter("traceNodeGUID"));
String model_GUID=HtmlFormat.format(request.getParameter("model_GUID"));
String taskID=HtmlFormat.format(request.getParameter("taskID"));
if("".equals(traceNodeGUID)){
if(!"".equals(taskID)){
FieldSet nodeTraceFs=dao.getFieldSetByFilter("WF_NODE_TRACE","WNT01="+user.getUserID()+" and WNT02="+taskID);//找出审批用户的跟踪节点GUID
if(nodeTraceFs!=null){
traceNodeGUID=HtmlFormat.format(nodeTraceFs.getString("WNT03"));
}
}
}
Map map=new LinkedHashMap(); 
String[] ids=traceNodeGUID.split(",");
for(int i=0;i<ids.length;i++){
map.put(ids[i],new HashMap());
}
String tagValue=HtmlFormat.format(request.getParameter("tagValue"));
String tagShow=HtmlFormat.format(request.getParameter("tagShow"));

DataTable dtLeft = dao.getDataTable("Select wn53,wn02 from wf_nodes,wf_model Where wm00=wn01 and (wn04='1' or wn04='3' or wn04='8') and wm05='"+model_GUID+"' order by wn46",1,Integer.MAX_VALUE);//这里model_GUID参数
//DataTable dtRight= dao.getDataTable("Select SPT00,SPT01 from TEMPLET_GROUP_V Where STS02='"+user.getUnitCode()+"' and spt00 in ("+id+")",1,Integer.MAX_VALUE);
FieldSet fs= null;
 %>

其中倒数第三行，model_GUID未经过任何过滤，进入SQL语句导致SQL注入漏洞
 

漏洞伪POC

#2 sqlmap测试跑数据

随机选择两个进行测试,下面测试一

http://121.8.169.131:8089/cooperate/traceNodes.jsp?tagValue=1&tagShow=1&model_GUID=111&traceNodeGUID=111

效果如图所示

接下来测试二

http://oa.zhcpt.edu.cn/cooperate/traceNodes.jsp?tagValue=1&tagShow=1&model_GUID=111&traceNodeGUID=111

效果如图所示