用友TurboCRM存在基于时间的SQL盲注（sa权限）

### 简要描述： 暴东西有点慢。但是权限还挺高啊 ### 详细说明： login/forgetpswd.php出的问题 ### 漏洞证明： 界面 [<img src="https://images.seebug.org/upload/201408/07000005ba3d64f8e8e734139aef1877380a63e9.png" alt="image093.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/07000005ba3d64f8e8e734139aef1877380a63e9.png) http://220.178.27.116:8001/login/forgetpswd.php?ClearS=1&loginname=1 [<img src="https://images.seebug.org/upload/201408/0700001902440b224c36b0caf8fae6084a104d6b.png" alt="image095.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/0700001902440b224c36b0caf8fae6084a104d6b.png) 当前数据库turbocrm70 [<img src="https://images.seebug.org/upload/201408/07000032d080dfe209c9f5644fa9515144e024bf.png" alt="image097.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/07000032d080dfe209c9f5644fa9515144e024bf.png) http://www.kdlian.com:8001/login/forgetpswd.php?ClearS=1&loginname=1 [<img src="https://images.seebug.org/upload/201408/070000468901a321f4532dc91a69c6c9e556a7f9.png" alt="image099.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/070000468901a321f4532dc91a69c6c9e556a7f9.png) 当前用户sa [<img src="https://images.seebug.org/upload/201408/07000059107c8c789b448073eb205a3ca3317e20.png" alt="image101.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/07000059107c8c789b448073eb205a3ca3317e20.png)