VULHUB ™

### 简要描述： RT ### 详细说明： 漏洞位于：/yyoa/checkWaitdo.jsp文件中 ``` <% uName = request.getParameter("userID");//接收参数 // System.out.println(uName); if (uName != "null") { Connection con = ConnectionPoolBean.getConnection(); //System.out.println("手动检查的结果中有问题的记录:"); boolean l = false; try { uID = XiaoxsDbHelper.getInt(con, "select id from person where truename like '%" + uName + "%'");//sql语句直接拼接，无任何处理 uName = XiaoxsDbHelper.getString(con, "select truename from person where id=" + uID+" and isaway=0 and delflag=0 "); allrun=XiaoxsDbHelper.getInt(con,"select allrun from waitdoctrl where perid="+uID); for (int i = 1; i < 11; i++) { if (i == 1){ mtypeName = "协同"; runName="docrun"; } else if (i == 2){ mtypeName = "收文"; runName="govrec"; } else if (i == 3){ mtypeName = "发文"; runName="govsend"; } else if (i == 4){ mtypeName = "事件"; runName="rout"; } else if (i == 5){ mtypeName = "会议"; runName="meet"; } else if (i == 6){ mtypeName = "待发送"; runName="exsend"; } else if (i == 7){ mtypeName = "待签收";...

### 简要描述： RT ### 详细说明： 漏洞位于：/yyoa/checkWaitdo.jsp文件中 ``` <% uName = request.getParameter("userID");//接收参数 // System.out.println(uName); if (uName != "null") { Connection con = ConnectionPoolBean.getConnection(); //System.out.println("手动检查的结果中有问题的记录:"); boolean l = false; try { uID = XiaoxsDbHelper.getInt(con, "select id from person where truename like '%" + uName + "%'");//sql语句直接拼接，无任何处理 uName = XiaoxsDbHelper.getString(con, "select truename from person where id=" + uID+" and isaway=0 and delflag=0 "); allrun=XiaoxsDbHelper.getInt(con,"select allrun from waitdoctrl where perid="+uID); for (int i = 1; i < 11; i++) { if (i == 1){ mtypeName = "协同"; runName="docrun"; } else if (i == 2){ mtypeName = "收文"; runName="govrec"; } else if (i == 3){ mtypeName = "发文"; runName="govsend"; } else if (i == 4){ mtypeName = "事件"; runName="rout"; } else if (i == 5){ mtypeName = "会议"; runName="meet"; } else if (i == 6){ mtypeName = "待发送"; runName="exsend"; } else if (i == 7){ mtypeName = "待签收"; runName="exrec"; } else if(i==8||i==9) { continue; } else if(i==10){ mtypeName = "签报"; runName="furun1"; } l = checkDateIsRight(con, i, uID); run=XiaoxsDbHelper.getInt(con,"select "+runName+" from waitdoctrl where perid="+uID); // System.out.println("select "+runName+" from waitdoctrl where perid = "+uID); %> ``` 波及100+厂商，筛选其中25个案例： ``` http://115.238.97.83/yyoa/checkWaitdo.jsp?userID=1 http://218.25.24.214:8083/yyoa/checkWaitdo.jsp?userID=1 http://oa.wnq.com.cn/yyoa/checkWaitdo.jsp?userID=1 http://oa.shanghai-fanuc.com.cn/yyoa/checkWaitdo.jsp?userID=1 http://www.zxdoa.cn/yyoa/checkWaitdo.jsp?userID=1 http://office.xce.com.cn/yyoa/checkWaitdo.jsp?userID=1 http://oa.juntongtongxin.com/yyoa/checkWaitdo.jsp?userID=1 http://oa.hnca.com.cn/yyoa/checkWaitdo.jsp?userID=1 http://www.bbmtoa.com/yyoa/checkWaitdo.jsp?userID=1 http://oa.whvtc.net/yyoa/checkWaitdo.jsp?userID=1 http://www.fjlh.com.cn:8080/yyoa/checkWaitdo.jsp?userID=1 http://www.saptcom.net/yyoa/checkWaitdo.jsp?userID=1 http://oa.jstedu.com/yyoa/checkWaitdo.jsp?userID=1 http://oa.ticom.com.cn/yyoa/checkWaitdo.jsp?userID=1 http://www.sciae.com.cn/yyoa/checkWaitdo.jsp?userID=1 http://www.zxdoa.cn/yyoa/checkWaitdo.jsp?userID=1 http://qudao.seeyon.com/yyoa/checkWaitdo.jsp?userID=1 http://www.brightoa.com/yyoa/checkWaitdo.jsp?userID=1 http://bg.aimin.gov.cn/yyoa/checkWaitdo.jsp?userID=1 http://oa.wnq.com.cn/yyoa/checkWaitdo.jsp?userID=1 http://oa.hnlt.com.cn/yyoa/checkWaitdo.jsp?userID=1 http://www.yaoye.cn/yyoa/checkWaitdo.jsp?userID=1 http://oa.holpe.net/yyoa/checkWaitdo.jsp?userID=1 http://211.144.15.87:8080/yyoa/checkWaitdo.jsp?userID=1 http://www.baojiyijian.com:8080/yyoa/checkWaitdo.jsp?userID=1 ``` ### 漏洞证明： http://115.238.97.83/yyoa/checkWaitdo.jsp?userID=1 [<img src="https://images.seebug.org/upload/201503/3118234238d62b67a758ab6557ae5685708ee067.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/3118234238d62b67a758ab6557ae5685708ee067.png) http://oa.shanghai-fanuc.com.cn/yyoa/checkWaitdo.jsp?userID=1 [<img src="https://images.seebug.org/upload/201503/3118275410176955d2055ff38bbe05c821d54bfa.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/3118275410176955d2055ff38bbe05c821d54bfa.png) http://oa.wnq.com.cn/yyoa/checkWaitdo.jsp?userID=1 [<img src="https://images.seebug.org/upload/201503/31182825a0f87029161b8d06e0918dcd407de169.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/31182825a0f87029161b8d06e0918dcd407de169.png) http://218.25.24.214:8083/yyoa/checkWaitdo.jsp?userID=1 [<img src="https://images.seebug.org/upload/201503/31182918fa1b89780f7ce4cb4283ba54faed9bbc.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/31182918fa1b89780f7ce4cb4283ba54faed9bbc.png) http://office.xce.com.cn/yyoa/checkWaitdo.jsp?userID=1 [<img src="https://images.seebug.org/upload/201503/31183224df292d2123766eff929ae5dd71bf4d80.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/31183224df292d2123766eff929ae5dd71bf4d80.png)