漏洞简介

红帆iOffice的/ioffice/prg/Mobile/Base/MobileBind.aspx接口存在SQL注入漏洞。攻击者可通过构造恶意SQL语句，未经身份验证地获取数据库敏感信息，影响范围包括红帆iOffice系统的数据访问权限。

影响版本

fofa语法

(title="iOffice.net" || body="/iOffice/js" || (body="iOffice.net" && header!="couchdb" && header!="drupal") || body="iOfficeOcxSetup.exe" || body="Hongfan. All Rights Reserved")

漏洞分析

先看下MobileBind.aspx 里引用的代码在哪里（Inherits）

<%@ Page Language="vb" AutoEventWireup="false" CodeBehind="MobileBind.aspx.vb" Inherits="Mobile.MobileBind"
    MasterPageFile="~/prg/set/ioPage/ioPageEdit.master" %>

去bin目录找到MobileBind.dll后编译打开，看MobileBind它的实现逻辑

public class MobileBind : WebPageBase
{
[field: AccessedThroughProperty("txtUDIDReqHisID")]
protected virtual TextBox txtUDIDReqHisID { get; [MethodImpl((MethodImplOptions) 32)] set; }

private bool SaveData()
{
  DataTable dataTable = Mobile.Mobile.GetclientUDIDReqHisByID(this.txtUDIDReqHisID.Text);
  if (dataTable.Rows.Count > 0)
  {
    switch (Mobile.Mobile.bindClientUDID((Array) new string[2]
    {
      Conversions.ToString(dataTable.Rows[0]["LoginID"]),
      Conversions.ToString(dataTable.Rows[0]["UDID"])
    }))
    {
      case -2:
        Page page1 = ((Control) this).Page;
        pf.ShowMessage(ref page1, "不允许绑定重复设备");
        ((Control) this).Page = page1;
        return false;
      case -1:
        Page page2 = ((Control) this).Page;
        pf.ShowMessage(ref page2, "当前登录号只允许绑定一个移动设备");
        ((Control) this).Page = page2;
        return false;
    }
  }
  return true;
}

最开始的一些变量定义，前端按钮cmdUDIDReqHis以及cmdClearAll

对应后端的两个逻辑

private void cmdUDIDReqHis_Click(object sender, EventArgs e)
{
  this.SaveData();
  this.BindDataGrid();
}

private void cmdClearAll_Click(object sender, EventArgs e)
{
  this.ClearSaveData();
  this.BindDataGrid();
}

跟进SaveData看下

private bool SaveData()
{
  DataTable dataTable = Mobile.Mobile.GetclientUDIDReqHisByID(this.txtUDIDReqHisID.Text);
  if (dataTable.Rows.Count > 0)
  {
    switch (Mobile.Mobile.bindClientUDID((Array) new string[2]
    {
      Conversions.ToString(dataTable.Rows[0]["LoginID"]),
      Conversions.ToString(dataTable.Rows[0]["UDID"])
    }))
    {
      case -2:
        Page page1 = ((Control) this).Page;
        pf.ShowMessage(ref page1, "不允许绑定重复设备");
        ((Control) this).Page = page1;
        return false;
      case -1:
        Page page2 = ((Control) this).Page;
        pf.ShowMessage(ref page2, "当前登录号只允许绑定一个移动设备");
        ((Control) this).Page = page2;
        return false;
    }
  }
  return true;
}

txtUDIDReqHisID被带入Mobile.Mobile.GetclientUDIDReqHisByID 方法，跟进看下

public static DataTable GetclientUDIDReqHisByID(string ID)
{
  return SqlData.ExecuteDataset(Globals.ConnectString, (CommandType) 1, $"select * from clientUDIDReqHis where ID in ({ID})").Tables[0];
}

ok,到这里，漏洞成因就非常明了了，从前端TextBox获取的txtUDIDReqHisID最终经过一系列赋值传递后被直接拼接进$"select * from clientUDIDReqHis where ID in ({ID})" sql语句里，全程无过滤或者校验，从而造成了SQL注入漏洞。

漏洞复现

漏洞复现需要打开漏洞文件页面获取一些其他必要参数如__VIEWSTATE之类

POST /ioffice/prg/Mobile/Base/MobileBind.aspx HTTP/1.1
Host: ioffice.mrxn.net
Content-Type: application/x-www-form-urlencoded

__EVENTTARGET=ctl00%24cntForm%24cmdUDIDReqHis&__EVENTARGUMENT=&__VIEWSTATE=xxxx&__VIEWSTATEGENERATOR=xxxxx&btVerify=&ctl00%24cntForm%24txtUDIDReqHisID=SQLI_POC&ctl00%24cntForm%24cmdUDIDReqHis=Button

成功利用报错注入在响应回显当前数据库用户信息